Analysis of Network Traffic using Intrusion Detection Systems

Analysis of Network Traffic using Intrusion Detection Systems Intrusion Detection Systems (IDS) in general, are appliances that monitor a network or a computer system for intrusions [7]. The term intrusion detection, as used in IDS, can have different meanings: it might describe the detection of an actual intrusion, where an attacker illegitimately tries to gain access to a corporate network, but includes also the detection of malware and viruses or the enforcement of corporate policies (e.g., no sharing of pdf documents via e-mail). Depending on the system and the configuration, an IDS will trigger an alarm or event if it detects what it defines as an intrusion Traditionally, IDS are categorized according to the data they are analyzing: Hostbased Intrusion Detection Systems (HIDS) are placed on the host of interest and typically monitor Operating System (OS) operations and log files. NIDS can be put in two categories depending on the used detection method: • The first category are anomaly-based NIDS .They use behavior based techniques, implemented in Anomaly Detection Algorithms (ADAs) by defining a model of normal network behavior, and then detecting deviations to this model. The second category of NIDS are signature-based systems. They use a precise definition of known attacks and match bypassing network traffic against this definition. This implies that a database with definitions of observed attacks has been established in advance. Such attack definitions are called signatures or rules. In this project, you are required to build a test bed consisting of several virtual machines to simulate real networking environment. Attack traffic is captured and analyzed by open-source IDS (Snort, Suricata, Zeek) using both offline and in-line traffic analysis. You will implement and document the steps given in this project. You should submit your final report containing a description of the tasks you have done and the results of the analysis generated by the security systems. You are also required to include snapshots for every step you have conducted. you must expert in these tools: Virtual Box, Kali, Wireshark, Nmap, Metasploit, netcat, Snort, Suricata, Zeek deadline 12/2/2023