Snort ids system visualization interface for alert analysis
Over the past decades, the rapid Internet development and the growth in the number of its users have raised various security issues. Therefore, it is of great importance to ensure the security of the network in order to enable the safe exchange of confidential data, as well as their integri...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Faculty of Technical Sciences in Cacak
2022-01-01
|
| Series: | Serbian Journal of Electrical Engineering |
| Subjects: | |
| Online Access: | http://www.doiserbia.nb.rs/img/doi/1451-4869/2022/1451-48692201067G.pdf |
| _version_ | 1818141060589682688 |
|---|---|
| author | Gavrilović Nađa Ćirić Vladimir Lozo Nikola |
| author_facet | Gavrilović Nađa Ćirić Vladimir Lozo Nikola |
| author_sort | Gavrilović Nađa |
| collection | DOAJ |
| description | Over the past decades, the rapid Internet development and the growth in the
number of its users have raised various security issues. Therefore, it is of
great importance to ensure the security of the network in order to enable
the safe exchange of confidential data, as well as their integrity. One of
the most important components of network attack detection is an Intrusion
Detection System (IDS). Snort IDS is a widely used intrusion detection
system, which logs alerts after detecting potentially dangerous network
packets. A major challenge in network monitoring is the high volume of
generated IDS alerts. A necessary step in successful network protection is
the analysis of the great amount of logged alerts in search of deviations
from normal traffic that may indicate an intrusion. The goal of this paper
is to design and implement a visualization interface for IDS alert analysis,
which graphically presents alerts generated by Snort IDS. Also, the proposed
system classifies the alerts according to the most important attack
parameters, and allows the users to understand evolving network situations
and easily detect possible traffic irregularities. An environment in which
the system has been tested in real-time is described, and the results of
attack detection and classification are given. One of the detected attacks
is analyzed in detail, as well as the method of its detection and its
possible consequences. |
| first_indexed | 2024-12-11T10:53:53Z |
| format | Article |
| id | doaj.art-43471b6d54c14caeaa97975c6393fa84 |
| institution | Directory Open Access Journal |
| issn | 1451-4869 2217-7183 |
| language | English |
| last_indexed | 2024-12-11T10:53:53Z |
| publishDate | 2022-01-01 |
| publisher | Faculty of Technical Sciences in Cacak |
| record_format | Article |
| series | Serbian Journal of Electrical Engineering |
| spelling | doaj.art-43471b6d54c14caeaa97975c6393fa842022-12-22T01:10:09ZengFaculty of Technical Sciences in CacakSerbian Journal of Electrical Engineering1451-48692217-71832022-01-01191677810.2298/SJEE2201067G1451-48692201067GSnort ids system visualization interface for alert analysisGavrilović Nađa0Ćirić Vladimir1Lozo Nikola2Faculty of Electronic Engineering, University of Niš, Niš, SerbiaFaculty of Electronic Engineering, University of Niš, Niš, SerbiaFaculty of Electronic Engineering, University of Niš, Niš, SerbiaOver the past decades, the rapid Internet development and the growth in the number of its users have raised various security issues. Therefore, it is of great importance to ensure the security of the network in order to enable the safe exchange of confidential data, as well as their integrity. One of the most important components of network attack detection is an Intrusion Detection System (IDS). Snort IDS is a widely used intrusion detection system, which logs alerts after detecting potentially dangerous network packets. A major challenge in network monitoring is the high volume of generated IDS alerts. A necessary step in successful network protection is the analysis of the great amount of logged alerts in search of deviations from normal traffic that may indicate an intrusion. The goal of this paper is to design and implement a visualization interface for IDS alert analysis, which graphically presents alerts generated by Snort IDS. Also, the proposed system classifies the alerts according to the most important attack parameters, and allows the users to understand evolving network situations and easily detect possible traffic irregularities. An environment in which the system has been tested in real-time is described, and the results of attack detection and classification are given. One of the detected attacks is analyzed in detail, as well as the method of its detection and its possible consequences.http://www.doiserbia.nb.rs/img/doi/1451-4869/2022/1451-48692201067G.pdfintrusion detectionalert analysissnortvisualization |
| spellingShingle | Gavrilović Nađa Ćirić Vladimir Lozo Nikola Snort ids system visualization interface for alert analysis Serbian Journal of Electrical Engineering intrusion detection alert analysis snort visualization |
| title | Snort ids system visualization interface for alert analysis |
| title_full | Snort ids system visualization interface for alert analysis |
| title_fullStr | Snort ids system visualization interface for alert analysis |
| title_full_unstemmed | Snort ids system visualization interface for alert analysis |
| title_short | Snort ids system visualization interface for alert analysis |
| title_sort | snort ids system visualization interface for alert analysis |
| topic | intrusion detection alert analysis snort visualization |
| url | http://www.doiserbia.nb.rs/img/doi/1451-4869/2022/1451-48692201067G.pdf |
| work_keys_str_mv | AT gavrilovicnađa snortidssystemvisualizationinterfaceforalertanalysis AT ciricvladimir snortidssystemvisualizationinterfaceforalertanalysis AT lozonikola snortidssystemvisualizationinterfaceforalertanalysis |