3

I am doing my senior project on network intrusion detection system (Ethernet networks) and I am having a bit of trouble deciding if I have added enough features.

Currently the system detects the following things:

  • ARP Cache poisoning attacks
  • TCP DOS attacks
  • UDP DOS attacks
  • ICMP Floods
  • TCP Port scanning
  • UDP Port scanning
  • Web policy violations FTP and Telnet will be added soon

It understands Snort rules, and using the publicly available Snort signatures can detect the use of network mapping tools and several other things.

So my question is:

Have I packed enough features to the system for it to be called a baseline NIDS?

Improve this question
0

2 Answers 2

Reset to default
6

By definition, that is a NIDS. That may or may not be enough for your project.

What is possibly more important for a real world NIDS is how it is updated, how is is tuned, how it is managed, how it reports on exceptions or alerts etc. Any of the following would be useful in a NIDS.

  • Updates - using Snort signatures is useful. Is there any heuristic/learning capability
  • Tuning - how do you train the system, and keep it updated when network topography or usage changes?
  • Management - is this standalone or part of an array?
  • Reporting - do you alert on thresholds, likelihoods, or just on a signature match
  • Logging - what do you log, and where? Syslog server functionality?
Improve this answer
3
  • Also policy update on switch. When you detect the scanner, you can block it on the router so it's blocked from the network completely, or its authentication is rejected on LAN. Also, visual ANALYSER like Snorby, which helps to understand and create new signatures.
    – Andrew Smith
    Commented Aug 13, 2012 at 11:19
  • Updates- I have already developed Update server that serves signature files
    – yohannist
    Commented Aug 13, 2012 at 18:13
  • Managment- Standalone. Reporting- On thresholds and signature match. Alert can be sent to network client program. Logging- All events are logged to file. The source and destination of the offending packet, the violation and time is logged
    – yohannist
    Commented Aug 15, 2012 at 19:14
2

If you want to compare the feature-set of your NIDS then I suggest you look at Security Onion, is an awesome Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It's currently 32-bit and based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico and many other security tools. I'd recommend checking out

IMHO, for a NIDS device to be useful, it has to be a NSM. Many NIDS failed because they were simply installed due to some regulation, compliance request or recommendation from a Big-4 consultant (not dissing all Big-4 consultants, some are excellent such as Rory...this regularly happened) and the internal staff managing the NIDS device could barely spell TCP/IP. You have to think of usability:

  • ease of use
  • ease of install
  • ease of understanding
  • ease of turning the alerts into something human-understandable by management

Security Onion is a complex beast that's been around for 3 years now (I think) so is far from baseline but check it out and take the pre-requisite features. It's also worth installing to see how Doug has implemented his solution. It's been actively used in very large environments so it's definitely relevant for your project.

It is going under a complete rebuild to x64 as a fyi.

The wiki is here and some presentations here.

This is in addition to the excellent comments from @RoryAlsop.

Disclaimer: I try to help (Doug & Scott) out on Security Onion.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .