Real time intrusion detection and prevention system

Abstract

Major challenge for organizations in today’s era is to meet the security needs. Techniques for logging data, detecting intrusions, preventing intrusions have been evolving for years. This paper presents a solution to combine logging, and network based intrusion detection and prevention system. The system has been developed considering the Software Engineering framework of requirements analysis, design, implementation, and testing. For IPS open source tool snort is configured in inline mode, so that sensors captures packets and drops them in case of any suspicious activity is observed. Signatures for Detection and prevention help IPS in alerting the administrator and dropping the packet. Logging of dropped packets is done using Splunk. In the process it provides for cost effective, customizable and scalable solution alternative to Organizations.