NetFlow Based Intrusion Detection System

• Main Authors: Po-Wei Wang, 王博瑋
• Other Authors: Tsang-Long Pao
• Format: Others
• Language: en_US
• Published: 2004
• Online Access: http://ndltd.ncl.edu.tw/handle/82779373654190533992

碩士 === 大同大學 === 資訊工程學系(所) === 92 === Due to the popularity of Internet, people can access remote resource on the Internet conveniently. But numerous malicious network events such as computer virus and hacker attack make the network management more difficult. A network intrusion detection system is thus more and more demanding. In this thesis, a NetFlow based anomaly intrusion detection system is presented. In addition, guidelines to properly configure and setup network device to minimize the possibilities that network attacks come from inside are also proposed. As the Internet becomes the platform of daily activities, the threat of network attack is also become more serious. Firewall along is not capable to protect the system from being attacked through normal service channel. Furthermore, most of the current intrusion detection system focus on the border of organization network which does not provide protection to hosts in the local network and the network itself if the attack is from inside. Therefore, in addition to the firewall and border IDS, we need to use other type of intrusion detection system to protect the critical system as well as the network itself.We propose an inexpensive and easy to implement way to perform the anomaly type intrusion detection based on the NetFlow information exported from the routers or other network probes. Our system can detect several types of network attack from inside or outside and perform counter maneuver accordingly.