Design and Development of Graphical User Interface for building Snort Rules

Abstract

Network Security is becoming an important issue for all the organizations, and with the increase in knowledge of hackers and intruders they have made many successful attempts to bring down high-profile company networks and web services. With the recent advances in the field of network security a technique called Intrusion Detection System are develop to further enhance and make your network secure. It is a way by which we can protect our internal network from outside attack, and can take appropriate action if needed. Using intrusion detection methods, information can be collected from known types of attack and can be used to detect if someone is trying to attack the network. Both open source and commercial tools are available for detecting intrusion in a network, many vulnerability assessment tools are also available in the market. Many techniques are there to detect intrusion in a network like signature matching, anomaly based and others. The thesis starts with the introductive study of various kinds of attacks in the network and then different tools to protect network from various malicious activities are studied. Then the detailed analysis of IDS is carried out. IDS components, types were studied based upon different factors. After that Snort network based intrusion detection is studied and analyzed. Its rule making process is discussed. In the end live traffic is captured using Snort itself and using wireshark also and the traffic is analyzed with the help of Snort. Rules are created in Snort. Finally a front end is created to implement Snort in a GUI based environment. The front end is used in the live environment.