Intruder detection system

nethunter · 12-26-2005, 01:38 PM

Iam a student, a novice in the linux. Iam assigned the project of creating a intrusion detection system in linux. Is it possible to create it in two months for a novice like me?? where can I get the required help and papers? Plz help.

Mara · 12-26-2005, 01:45 PM

It depends. I you want to have a professional one, like let's say Snort, it's not possible. If you want to show how it looks and works, I see no problem. IDS is a large topic, however, and you should know first what kind of IDS you want to build.

nethunter · 12-26-2005, 01:50 PM

Well I dont need a professional one. I need that for a student project so it's enough if does the tasks like scanning da ports etc. Just the basic model will do. Any reply and help will be appreciated.

Mara · 12-26-2005, 02:02 PM

You need to define the requirements carefully. Port scans can be detected easily (by just counting SYNs in time intervals). The biggest decision is if you want to write a signature-based one or behaviour-based one. BTW first option is easier.

Here's a link to a FAQ: http://www.sans.org/resources/idfaq/ Enough to see what's all the thing about.

true_atlantis · 12-27-2005, 11:05 PM

when you say 'create an intrusion detection system' do you mean write a IDS program, or do you mean setup an IDS? those are two totally different tasks.

nethunter · 12-28-2005, 10:22 AM

I want to write a program for the intrusion detection system. I jus wanna code a simple knowledge based intrusion detection system. Where can I get some sample codes??

true_atlantis · 12-28-2005, 01:29 PM

i dont think your going to be able to find any sample codes out there... if i were you, i would set up an IDS like snort, and see how it works, to get ideas of how to implement it.

Mara · 12-28-2005, 02:37 PM

Knowledge-based IDS is usually just a simple scanner. The hardest thing is to parse the rules it has. If you hard--code them, it's really easy. Example: 5 SYNs from one IP in less than a minute means scan. Simple, right? Choose language and the network-access library (like pcap when you decide to write in C).

despotic · 12-28-2005, 04:36 PM

Quote:

Originally Posted by nethunter

I want to write a program for the intrusion detection system. I jus wanna code a simple knowledge based intrusion detection system. Where can I get some sample codes??

I guess this is the point of your project isn't it ... why don't you just do your homework, or ask your Prof, TA's for pointers? Geez!

aq_mishu · 12-31-2005, 01:00 AM

Right... Be sure from your prof what he really wants.. a setup or a complete program.. and also what kind... Then get help from TAs and net...