Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm
The rapid development of internet greatly helps human work. However, the number of information system security incidents has risen sharply, so that in fact the sides of human life are threatened. Detection techniques against attacks on computer networks must be continuously developed so that integri...
| Main Authors: | , , |
|---|---|
| Format: | Conference or Workshop Item |
| Language: | English English |
| Published: |
Springer
2020
|
| Subjects: | |
| Online Access: | http://umpir.ump.edu.my/id/eprint/27571/1/142.%20Campus%20hybrid%20intrusion%20detection%20system%20using%20SNORT%20and%20IPTables.pdf http://umpir.ump.edu.my/id/eprint/27571/2/142.1%20Campus%20hybrid%20intrusion%20detection%20system%20using%20SNORT%20and%20IPTables.pdf |
| _version_ | 1796993901786038272 |
|---|---|
| author | Slamet, . Izzeldin, I. Mohd Fahmi, Samsuri |
| author_facet | Slamet, . Izzeldin, I. Mohd Fahmi, Samsuri |
| author_sort | Slamet, . |
| collection | UMP |
| description | The rapid development of internet greatly helps human work. However, the number of information system security incidents has risen sharply, so that in fact the sides of human life are threatened. Detection techniques against attacks on computer networks must be continuously developed so that integrity, availability and confidentiality on a computer network become more secure. Most of current intrusion detection systems only use one of the two detection methods, misused detection or anomaly detection, both of them have their own
limitations. In this paper, the authors built Hybrid Intrusion Detecting System combines misuse detection system with anomaly detection system. The basis of misused detection module is snort, and anomaly detection module is constructed by using Algorithm C4.5 detectors. This system works by creating alerts built from an engine that reads the parameters in the attacker's IP address. Webmin is used to simplify rule management. Whereas for analyzing logs (attack history), an ACID (Analysis Console for Intrusion Databases) is used. Attack and detection testing is carried out in the campus network of Institut Bisnis dan Informatika Stikom Surabaya. The system implementation uses a PC Router with the Ubuntu 18.04 Linux as operating system. As a result of implementing this system: misused detection module uses the signature of attacks to detection the known attacks; anomaly detection module can detect the unknown attacks; signature generation module extracts the signature of attacks that are detected by Anomaly Detection System module, and maps the signatures into snort rules. |
| first_indexed | 2024-03-06T12:40:23Z |
| format | Conference or Workshop Item |
| id | UMPir27571 |
| institution | Universiti Malaysia Pahang |
| language | English English |
| last_indexed | 2024-03-06T12:40:23Z |
| publishDate | 2020 |
| publisher | Springer |
| record_format | dspace |
| spelling | UMPir275712020-07-15T03:39:52Z http://umpir.ump.edu.my/id/eprint/27571/ Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm Slamet, . Izzeldin, I. Mohd Fahmi, Samsuri TK Electrical engineering. Electronics Nuclear engineering The rapid development of internet greatly helps human work. However, the number of information system security incidents has risen sharply, so that in fact the sides of human life are threatened. Detection techniques against attacks on computer networks must be continuously developed so that integrity, availability and confidentiality on a computer network become more secure. Most of current intrusion detection systems only use one of the two detection methods, misused detection or anomaly detection, both of them have their own limitations. In this paper, the authors built Hybrid Intrusion Detecting System combines misuse detection system with anomaly detection system. The basis of misused detection module is snort, and anomaly detection module is constructed by using Algorithm C4.5 detectors. This system works by creating alerts built from an engine that reads the parameters in the attacker's IP address. Webmin is used to simplify rule management. Whereas for analyzing logs (attack history), an ACID (Analysis Console for Intrusion Databases) is used. Attack and detection testing is carried out in the campus network of Institut Bisnis dan Informatika Stikom Surabaya. The system implementation uses a PC Router with the Ubuntu 18.04 Linux as operating system. As a result of implementing this system: misused detection module uses the signature of attacks to detection the known attacks; anomaly detection module can detect the unknown attacks; signature generation module extracts the signature of attacks that are detected by Anomaly Detection System module, and maps the signatures into snort rules. Springer 2020 Conference or Workshop Item PeerReviewed pdf en http://umpir.ump.edu.my/id/eprint/27571/1/142.%20Campus%20hybrid%20intrusion%20detection%20system%20using%20SNORT%20and%20IPTables.pdf pdf en http://umpir.ump.edu.my/id/eprint/27571/2/142.1%20Campus%20hybrid%20intrusion%20detection%20system%20using%20SNORT%20and%20IPTables.pdf Slamet, . and Izzeldin, I. Mohd and Fahmi, Samsuri (2020) Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm. In: InECCE2019: Proceedings of the 5th International Conference on Electrical, Control & Computer Engineering , 29th July 2019 , Kuantan, Pahang, Malaysia. pp. 591-603., 632. ISBN 978-981-15-2317-5 https://doi.org/10.1007/978-981-15-2317-5_50 |
| spellingShingle | TK Electrical engineering. Electronics Nuclear engineering Slamet, . Izzeldin, I. Mohd Fahmi, Samsuri Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm |
| title | Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm |
| title_full | Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm |
| title_fullStr | Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm |
| title_full_unstemmed | Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm |
| title_short | Campus hybrid intrusion detection system using SNORT and C4.5 Algorithm |
| title_sort | campus hybrid intrusion detection system using snort and c4 5 algorithm |
| topic | TK Electrical engineering. Electronics Nuclear engineering |
| url | http://umpir.ump.edu.my/id/eprint/27571/1/142.%20Campus%20hybrid%20intrusion%20detection%20system%20using%20SNORT%20and%20IPTables.pdf http://umpir.ump.edu.my/id/eprint/27571/2/142.1%20Campus%20hybrid%20intrusion%20detection%20system%20using%20SNORT%20and%20IPTables.pdf |
| work_keys_str_mv | AT slamet campushybridintrusiondetectionsystemusingsnortandc45algorithm AT izzeldinimohd campushybridintrusiondetectionsystemusingsnortandc45algorithm AT fahmisamsuri campushybridintrusiondetectionsystemusingsnortandc45algorithm |