Download
intrusion detection system n.
Skip this Video
Loading SlideShow in 5 Seconds..
Intrusion Detection System PowerPoint Presentation
Download Presentation
Intrusion Detection System

Intrusion Detection System

210 Views Download Presentation
Download Presentation

Intrusion Detection System

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. Intrusion Detection System Bruno Melo Diego da Silva Matheus Finatti Vinicio Meira Advised by Dr. Xiang Fu

  2. Intrusion Detection System • Monitor system processes • Detect • Analyze • Block Malicious Activities

  3. System Architecture • CLUSTER • IDS

  4. Support Vector Machine - SVM • Analyze Data • Recognize Patterns • Classify Data

  5. SVM

  6. SVM

  7. Classified Data SVM

  8. SVM Interface for IDS • Interface LIBSVM • SVM • IDS

  9. Cluster Operation Modes Training mode: $ python clustey.py --train -c <logfolder> -w <function name> Predict mode: $ python cluster.py --judge -r <modelfile> * Test data is in the environment variable called “request”

  10. Main Module - Java™ Program • Generate C++ Wrappers • LD_PRELOAD • LD_LIBRARY_PATH • dlsym() • Intercept and log Apache library calls • Monitor Apache library calls • How to generate wrappers?

  11. Configuration File

  12. IDS Operation Modes - Train • Parse Configuration File • Generate and compile wrapper • Start Apache • Intercept calls and generate log files

  13. IDS Operation Modes – Complete Train • Stop Apache • Send log files to cluster’s training mode

  14. IDS Operation Modes – Monitor • Parse configuration file • Generate and compile wrapper • Start listening server to communicate with wrapper • Start Apache • Intercept calls and send to listening server • Send response to C++ wrapper • Send log entry to cluster to analyze • If rejected, ask user if Apache should be killed

  15. Using IDS Modes • Training mode: • # java –jar ids.jar -c <configfile> -o <outfile> -mode train [-v|-i] • Complete train mode: • # java –jar ids.jar –p <logpath> -mode completetrain • Monitor mode: • # java –jar ids.jar -c <configfile> -o <outfile> -mode monitor

  16. Demonstration