CrazyEngineers
CrazyEngineers

  • Data Visualization for Intrusion Detection System

    mayjune

    Member

    Updated: Oct 26, 2024
    Views: 1.1K
    Intrusion Detection System with Data Visualization

    Hi,
    I want to make an IDS (Intrusion Detection System) using Data Visualization. I am currently pursuing CCNA, and IT Engg 4th Year. Although there is a lot of material on it, I am not understanding how to approach it, what language would be best to implement it, (as we want to do data visualization too) there are so many papers which are giving various models on IEEE websites.

    If anyone could help us in taking this forward it would be great. We have selected Networking and Security as our domain for the future, hence we think this would be the right project for us to get the basic idea of how attack happens, and how it is detected. The idea is not to make something great at first, but to understand the concepts of security through the project. If anyone has a better idea of how we can improve this it would be great.

    Please feel free to ask any questions if you have.

    Thanks.
    0
    Replies
Howdy guest!
Dear guest, you must be logged-in to participate on CrazyEngineers. We would love to have you as a member of our community. Consider creating an account or login.
Replies

  • Manish Goyal

    Member • Aug 3, 2010

    Basically if your purpose is to capture and analyze packets then you can go for java

    Here you can use third party tool jpcap which provides a lot of inbuilt classes as well as functions for capturing packets and analyze it
    Are you sure? This action cannot be undone.
    Cancel

  • mayjune

    Member • Aug 3, 2010

    Ok. Thats a Good Start. What about the Data Visualization part? Do you think Java would be helpful in that?
    I'll give you an idea of how it can be helpful. Lets say Host A has IDS installed. I have an XY plotted graph, in which X represents Time. And Y represent Port No. of that Host. Each time a Host is accessed, A Dot is represnted on the graph. Different Source IP represent Diff color.

    Now lets say Host B wants to hack Host A. It first starts with Port Scanning. In port scanning as you may know, it will try pinging each port to get a reply back.
    Now if on the graph, I'll see a line going on lets say from 12000 - 13000 port nos from time 5:30:00 - 5:32:00. If i see the source IP add, i can make out its from the same IP add. Hence i can conclude that Host B is trying to hack my computer.
    Are you sure? This action cannot be undone.
    Cancel
Home Channels Search Login Register