The Development of a Intrusion Detection / Defense System for Linux Hosts

As distributed computer systems perform an increasing number of essential services the consequences of the failure of these mission critical networks become more catastrophic. A significant number of networks are susceptible to performance degradations due to the malicious acts of intruders. Some of the current approaches to decreasing the Mean Time Between Failures (MTBF) Of computer networks have focused on designing feedback systems based on intrusion detection and defense to increase the survivability of networks. The paper describes requirements, techniques and issues pertaining to the development of an ID/DS capability for Linux hosts. Introduction One of the most important networking problems is assuring that the network and its resources perform as expected. If network’s behavior is unpredictable or unexpected, such a network is insecure [1]. Therefore, to assure that a network performs as expected it must be secure. Many researchers in the field of network security have stated that network security is a process that tries to optimize two characteristics of secure systems. The two characteristics are integrity and confidentiality. Having integrity means the system and its information remain unaltered by accidents or malicious attacks while confidentiality means the data that is in the system must be available only to users who are authorized to access and manipulate the information or resources on the network [2]. Once a computer system has both integrity and confidentiality, we can claim that the system is trusted. If we trust the system, we can then consider it secure. To assure that the network and its services are secure recommended practices call for System Administrators to develop or implement a security system generally referred to as Intrusion Detection/Defense System (ID/DS) [3]. Intrusion detection (ID) systems are prevalent in distributed systems; for example, telephone networks use intrusion detection systems to prevent the large-scale misuse of corporate phone services. Other distributed systems where ID technologies are implemented are in the satellite industry and power networks [4]. Intrusion Detection Systems (IDS) are popular in these different infrastructure networks for a number of reasons. The first one is that as distributed systems increase in size and complexity the ability of human operators to detect system breaches in real time decreases. However, with the aid of an automated system monitoring tool administrators are able to maintain the integrity of the network. Another factor that leads to the popularity of IDS is that the majority of these distributed systems run continuously; however, personnel to watch the network are not always available or on site. Having an automated system monitor alert administrators allows the network to be administered remotely. The last reason for deploying a IDS in a computer network is that currently most attacks on computer networks are initiated with the aid of scripts, which can launch thousands of automated stacks on a computer network. Most non-automated defensive and detective methods would be overwhelmed by the scripted attacks. Parties responsible for maintaining a network’s integrity and trust have found that using a IDS the network will not be overwhelmed.