A novel intrusion detection system (IDS) architecture. Attack detection based on snort for multistage attack scenarios in a multi-cores environment.

摘要

Recent research has indicated that although security systems are developing,udillegal intrusion to computers is on the rise. The research conducted hereudillustrates that improving intrusion detection and prevention methods isudfundamental for improving the overall security of systems.udThis research includes the design of a novel Intrusion Detection System (IDS)udwhich identifies four levels of visibility of attacks. Two major areas of securityudconcern were identified: speed and volume of attacks; and complexity ofudmultistage attacks. Hence, the Multistage Intrusion Detection and PreventionudSystem (MIDaPS) that is designed here is made of two fundamental elements:uda multistage attack engine that heavily depends on attack trees and a Denial ofudService Engine. MIDaPS were tested and found to improve current intrusionuddetection and processing performances.udAfter an intensive literature review, over 25 GB of data was collected onudhoneynets. This was then used to analyse the complexity of attacks in a seriesudof experiments. Statistical and analytic methods were used to design the noveludMIDaPS.udKey findings indicate that an attack needs to be protected at 4 different levels.udHence, MIDaPS is built with 4 levels of protection. As, recent attack vectors useudlegitimate actions, MIDaPS uses a novel approach of attack trees to trace theudattacker¿s actions. MIDaPS was tested and results suggest an improvement toudcurrent system performance by 84% whilst detecting DDOS attacks within 10udminutes.