Improved Intrusion Detection System through Rule Based Approach on ICMP Protocol for Real Time Network

Abstract—In the field of network security, researchers have implemented different models to secure the network. Intrusion Detection System is also one of them and Snort is an open source tool for Intrusion Detection and Prevention System. Today intrusion Detection System is a growing technology in network security and mostly researchers have focused in this field, some of them used signature or rule-based technique and some are anomaly based techniques to improve security of network. In this thesis we propose a rule-base Intrusion Detection System with our selfgenerated new rules for TCP and ICMP protocol. These rules will be used to detect naive attacks in real time network using Snort and Basic Analysis Security Engine (BASE). BASE is used to view the snort results in font-end web page because Snort has no graphic user interface. In This rulebased Intrusion Detection System we will match the signature with our Efficient Rules from captured packet. As a definition of signature based IDS with this new IDS will be useful to reduce the false positive alarm.