2

I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the different features (like distributive nature of IDS etc.) instead of pointing out a real start. I just want to know from where I could start and what platform would be suitable for the same...

Improve this question

3 Answers 3

Reset to default
2

If you are reading academic papers, then it is likely you are going to be reading about esoteric features, distributed problems, and otherwise interesting OPEN issues in the ongoing battle of IDS.

If you are looking for (a) specific paper(s), then I would suggest looking for a SURVEY of existing systems. Surveys usually give some historical review with emphasis on the current state of the art. They are generally easy to read and light on hard-core analysis. I googled for "survey of intrusion detection systems" and got so many viable hits I won't even bother linking to any of them. You can try to focus purely on academia by hitting the major academic CS research websites such as CiteSeerX.

Since this is a term project, the nature of the system needs to be scalable. Don't try to go all out -- maybe try creating a host-based IDS instead of trying to tackle otherwise more difficult issues. You may also want to focus on something easy like a signature-based approach rather than a heuristic-based approach. Remember: the core problem you are trying to solve is that of Intrusion Detection, rather than, say, distributed systems.

Of course if you find yourself with more time on your hands at the end, then augment. Software development is an evolutionary process. Start with something simple and build out.

Improve this answer
1
  • What are the recent trends in IDS anyway???
    – Pankaj Anand
    Commented Jan 17, 2012 at 12:27
2

For an interesting look into a "research" IDS, you could also look at Bro. The website also has a lot of interesting documentation and links to papers and research topics.

Improve this answer
1
  • While Bro used to be a "reasearch" NIDS in the early days, it is now a production-grade NIDS. Particularly the 2.0 release has significantly improved user friendliness. Many researchers still use it as a network research building block due to its robust TCP stream reassembler and its matured protocol analyzers. To better understand the NIDS architecture, I recommend reading the original Bro paper and the NIDS cluster paper.
    – mavam
    Commented Mar 23, 2012 at 16:01
1

The Snort forums would be an excellent place to gain information. They are focused on the snort engine, but much of the discussion which isn't around configuring snort should be applicable to many IDS implementations.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .