A Study on Intrusion Detection Systems with a Practical Experiment on Snort
summary
Snort is implemented on Kali with its config, rules, MySQL schema and BASE for viewing; local rules flag ICMP and signature matches. Practical lab runs on two hosts (192.168.72.134 → 192.168.72.138) produce alerts for four test cases: Nmap TCP scan, Nmap XMAS stealth scan, FTP connection refused, and an hping3 TCP flood DoS. Alerts land in the database and BASE. Proposal builds a central logging system with a decision‑tree classifier, multi‑threaded workers, load balancing and packet‑duplication checks to reduce rule churn and false positives.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 1:05Overview of intrusion detection systems
- 3:57Introduction to Snort
- 5:23Snort implementation details
- 9:21Test case scenarios with Snort
- 13:55Analyzing alerts with BASE
- 15:00Existing vulnerabilities in Snort
- 18:09Proposed solutions for Snort
- 20:17Centralized logging system proposal
- 23:27Conclusion and acknowledgments
related talks
43mOpen Source Intelligence Based Intrusion Detection System
48mPutting an Intrusion Detection System to the Test
26mNetwork monitoring with FOSS
01h 41mAn introduction to Penetration Testing using Kali Linux
20mFrom Intention to Practice: Towards Systematic Validation of NIDS Rule Enforcement
06mUsing Genetic Algorithms for Network Intrusion Detection and Integration into nProbe
01h 00mA Security Tester's Toolbox
01h 01mA security tester's toolkit