Honeypot Based Intrusion Detection System: A framework for mitigating network attacks using honeypot and real time rule accession in Intrusion Detection System

Amazon Price: $62.16 (as of December 5, 2019 20:24 – Details). Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on the Amazon site at the time of purchase will apply to the purchase of this product.

The Intrusion Detection Systems (IDS) play an important role in protecting the organizations from unauthorized activities. In this dissertation work, a framework using honeypot is proposed with Real Time Rule Accession (ReTRA) capability. Honeypot is used to prevent the attack and collect attack traffic on the network. Furthermore, Apriori algorithm for association rule mining is used on the data logged by honeypot to generate rules which is added to the Snort IDS dynamically. This is different from the previous method of off-line rule base addition. The proposed IDS is efficient in detecting the attacks at the time of their occurrences even if the system was not equipped with rules to detect it. The logs generated by honeypots can grow very large in size when there is heavy attack traffic in the system, thus consuming a lot of disk space. The huge log size poses difficulty when they are processed and analyzed as they consume a lot of time and resources. The proposed system addresses these issues. The logging module for efficient capture of attack traffic saves disk space. The log analyzer processes this log to generate reports and graphs for the security administrators.

Product Details

  • Paperback: 68 pages
  • Publisher: LAP LAMBERT Academic Publishing (February 14, 2012)
  • Language: English
  • ISBN-10: 9783846583104
  • ISBN-13: 978-3846583104
  • ASIN: 3846583103
  • Product Dimensions: 5.9 x 0.2 x 8.7 inches
  • Shipping Weight: 5.3 ounces