Regular Upgrade of Cybersecurity at Different Levels

The government has implemented a cybersecurity policy framework that integrates privacy and safety, which builds trust and confidence among users. No single security method can fully protect an organization from threats, but the Cisco hierarchical network model can help reduce security risks by providing network sensors to monitor and detect potential threats. The implementation of this model in an organization's network is crucial for securing data and ensuring accountability through the signoff process.

Project Dissertation
Title:Next-GenerationCybertrap For Corporate Intrusion Detection Servers and
Intrusion Prevention Servers in Enterprise Business.

TABLE OF CONTENTS
INTRODUCTION...........................................................................................................................4
Aim and Objectives....................................................................................................................11
Background and motivation.......................................................................................................12
Problem......................................................................................................................................12
Proposed solution.......................................................................................................................12
Structure of thesis.......................................................................................................................12
Summary....................................................................................................................................13
LITERATURE REVIEW..............................................................................................................14
TECHNOLOGY............................................................................................................................21
APPROACH..................................................................................................................................34
DESIGN.........................................................................................................................................42
IMPLEMENTATION....................................................................................................................47
CONCLUSION..............................................................................................................................55
REFERENCES..............................................................................................................................56

ABSTRACT
Next Generation Intrusion Prevention Systems is also term as Intrusion Detection & Prevention
Systems (IDPS). Here we can see that Next Generation Cyber trap for corporate intrusion
detections server and intrusion prevention servers in Enterprise business that consists of different
network security applications which monitor the network and suspicious activities in the system.
This system will protect the corporate from the default attacks to the new attack and also controls
the system and prevent the system by the cyber threat. The expertise of Next-generation intrusion
prevention system helps to protect the sensitive data and the information also the application
from the cyber threat and manage the performance of the system. Our project is mainly focused
on explaining the different mitigation methodologies or techniques used by corporate for storing
information and data that is going to be used in the network system. Further, in our paper, we are
going to discuss more these things. In this type of mitigation plan, the attackers are not able to
penetrate inside the system and outside the system to secure fully. After implementing this
system in the corporate we will be able to find the types of attacks and methods used by the
attackers so that we can easily install that technology in our system to protect information and
data against different types of cyber threats.

CHAPTER 1
INTRODUCTION
1. INTRODUCTION
Cyber Trap becomes the trendsetting word in the growing generations’ minds who work
upon a lot on the internet. This word will be more familiar for the corporate companies as they
come through such problems day-to-day basis. They make their process on the internet which
will make their work so easier and instant. Believing in this, these crew people collect data
from the internet but they were not aware of the problems which will affect them later. Due to
this access of internet, the hidden side of the internet gets wild and gains a lot of profit, but
locating and targeting the small corporate companies because they don’t maintain high security
on the internet. But they do believe that they have strong security connections that no one could
enter the area and access the data. Their intention is completely wrong because Cyber trap is a
huge background trap that takes out the data from their site with ease of effort. They are
otherwise called as attackers of corporates who enjoy a lot in trapping and getting out the data
at the most level (Anita, K. et al., 2010).
According to a recent survey, it is obvious that 96% of the business people are fooled by
the Cyber Trap method. To know about the happenings, the company brought out an idea to
detect the attack made by the internet user. Then there was an emergence of a processor called
honeypots to detect the malware capture, which is placed in a corner of a network to capture the
attackers. The proposed system is capable of detecting the network attacks on significant
resources and to capture the malware being spread in the network. This system consists of
various modules to monitor the system after knowing and understanding the basics from the
human interaction. During the initial process of the detectors, they learn about the signature and

the behaviour of the malware. Later they were fed with the modern executables and binaries
system which them capable to find out the malware which harms the computing network. This
package checks for the malicious match to find out the harm material (Anita, K. et al., 2010).
Then cyber trap came into charge, the Intrusion Detection module which acts more effective
which watches out for the intrusion chances. When an attack is made, it comes into act making
an attentive alarm which intends in creating a honeypot to which will be the replica of the
victim resource. All the services which were running on the victim machine will be faked into
the honeypot, in case of this, the attacker will redirect. But the IDS are very conscious clear that
the redirected work should not be found out by the attacker. This additional feature of this
makes a good hype in this intrusion module detector. This even too provides a system called
sandbox, which will not harm the operation of the original resources and maintain the records
in a safe manner. There comes along an automated honeypot management system which
manages such critical circumstances. Every particular process will have a design feature which
goes from initial to final stages. This design has made with five different modules namely
Malware detector, an Intrusion detector, Honeypot Manager, Auditor and Backup manager
(Asmaa Shaker Ashoor, et al., 2012).
To know about the attackers, the inventors had different methods of a plan to make the
attackers attract towards their honeypots. To make this happen they made their trap by making
the server most requested one and high ranking one which will lure more attackers. By that
time, the initial stage which is the Malware detector checks for the incoming threats whereas
the other modules will not get into charge unless they are needed. The honeypot manager
created the honeypots for the attackers to be detected to the server, then the Auditor checks the
system for any malicious activity and in the generated logs after particular events next comes

the Backup manager who will in charge to backup the resources and honeypots whenever
necessary (Asmaa Shaker Ashoor, et al, 2012).
Malware Detector
The malware detector works with collaboration and runs independently on the internet
to detect and capture any malware in the network. This module consists of various functions,
search for malware in different ways, and later submits the result to the server for further
research. This module has 3 types naming fetcher, watcher and hunter. A fetcher is a service
which does cross-matching to catch any malicious files. Watcher watches the network for any
harm file to capture. Hunter is a pre-processor which extracts Windows binaries which come
into the network and checks them for the unwanted harm files (DerisStiawan et al, 2011).
Intrusion detector
Intrusion detector is similar when compared with the Hunter detector which is a pre-
processor which controls the calling of other modules. Whenever there is an intrusion, the
intrusion detector detects and shoots out an alert and calls other modules if necessary alone.
The intrusion detector module has a function for log parsing, which keeps its eyes on the log
for intrusion attempts. Even in this case, if a harm is detected an alarm is provided to the
administrator. The module looks for the harm, if any harm is detected, it connects with the
honeypot module to create a honeypot and deal further with the attacker (DerisStiawan et al,
2011).

Honeypot Manager
This is one of the important modules is the honeypot manager, which creates a honeypot
to locate the threats. The main function of this is to create a honeypot to take out the threats by
fetching information from the intrusion detector. This module provides a sandbox feature so
that the attacker can play inside the honeypot without interrupting the original resources
(DerisStiawan et al, 2011).
Auditor
The auditor module functions to collect all the data connecting to the network to check
for the intrusion or network changes. It checks for all changes which should be sent to the
Honeypot manager so that it can able to create an absolute replica of the damaged data
(DerisStiawan et al, 2011).
Backup Manager
The function of the Backup manager is so relevant to the name of the heading that it
should keep a backup of resources and the honeypots. This module takes regular backups and
always will be ready to provide the replica of resources and honeypots, to provide restoration in
case of any sudden events. It would also be capable of creating a Honeypot which was
previously attacked by the attacker. When instead of getting a clean honeypot, if an attacker
gets a resource with plenty amount, he might tend to leave some traces as the attacker will be
keen on taking out the data and the attacker will not be recognising that they are playing with
honeypot which would easily find out the attacker. The Honeypot manager too contains the
backup of the resource (DerisStiawan et al, 2011).

1.2 INTRUSION PREVENTION SERVER
Intrusion prevention is as similar to intrusion detector in which it is detected and taken
out, but the advanced level of it is the intrusion prevention which prevents the attackers enter
into the network which is much required every corporate company who maintain their most
valuable and important data in the network. An exploit may carry out an instant after the
attackers gain access whereas the intrusion prevention detector has the ability to take quick
action on it based on some kind of rules framed by the administrator. An effective intrusion
detector should perform very complex monitoring and analysis such as watching to the activity
and responding to the administrator patterns and individual patterns. To be factual, an Intrusion
Prevention System should use any product or method that is used to keep away the attackers
from compromising the networking using some concepts like firewalls and anti-virus software.
1.3 FIREWALL
Firewall is an internet security which controls the incoming signals and outgoing signals
in the networking server. Network firewalls filter the traffic between the signals and run on
computer hardware. Mostly, a firewall is always installed away from the remaining network so
that no other illegal signals enter into the private sector of the company.
The firewall has three layers which protect the data to be attacked.
1. Packet filters firewall
2. Stateful filters firewall
3. Application layer firewall

1.4 CHALLENGES OF INTRUSIVE DETECTION SERVER
Network and intrusion detection systems play a wide role in securing the data by
preventing the data entry into the servers of corporates. To know the capacity of the
technology, the organizations must face a number of challenges (Jaiganesh, V. et al., 2013).
The challenges are,
Ensuring an effective deployment
While receiving such threats from the attackers, the organisations must make sure that
the security is in a high level that is an effective deployment. In the world, many companies
were not aware of their entire view of the network so deploying Intrusive Detection server can
be so difficult.So the organization has to make sure that they ensure a good deployment
(Jaiganesh, V. et al., 2013).
1.4.1 Managing the high volume of alerts
To manage high-level threats, the server is fixed with a great alert signal which indicates
the illegal entry in the network or when the receiving signal does not match the pattern. So that
the alert volume should be hyperactive so that the company can compete for the internet world
with full confidence which too helps them maintain their data in a secure manner (John
McHugh, et al).
1.4.2 Understanding and investigating the alerts
Intrusive Detection Server consists of a very base level security, it looks so normal type of
security when it is placed alone. When updated with an alert, it looks good and effective for
detecting the threats. When the IDS is investigated for its alerts it takes very less time and

fewer resources when compared to the other system which tends to determine the seriousness
of the alarm. Special skills are required for interrupting the system output where the
organization may lack the security in performing such functions (John McHugh, et al).
1.4.3 Knowing how to respond to threats
IDS is very much effective in identifying the appropriate problem which is a great
feedback for the corporate companies but they couldn’t be too confident that they have high
security because Intrusion detection server just locates the problem which is just half the
problem solved. To solve the problem is important whereas responding correctly to the problem
is more important which behaves as the half the process of solving the problem. The lack
happens here in this IDS. Effective incident requires skills in this and have to know about the
robust procedures to solve the problem. To emphasize the importance of having unsuitable
incident response plan, the incoming General Data Protection Regulation(GDPR) requires
organizations that continue any type of data to have perfect controls in a perfect place to report
the security breaches to a related authority within two days or it will lead to a huge amount of
dues (John McHugh, et al).
1.5 ADVANTAGES OF INTRUSION DETECTION SERVER
1.5.1 Constant Network Monitoring
Constant Network monitoring continuously works all 24*7 for the corporates which
make them fear free from the attackers. This feature allows the server to be safe even when the
user is in sleep or awake. It maintains security and detects the attacker and produces an alert
signal to the management (PeymanKabiri and Ali A.Ghorbani, 2005).

1.5.2 Versatility of the system
Intrusive detection server is customizable to accommodate special client needs. The
appointment will be based on the versatile performance of an individual so that he can be
efficient enough to analyse the attacks and produce solutions to it. The system can monitor the
threats from both the inside and outside the network with the help of the system behaviour the
threats can be identified (PeymanKabiri and Ali A.Ghorbani, 2005).
1.6 DISADVANTAGE OF INTRUSIVE DETECTION SERVER
1.6.1 Telling a threat from a friend
The main disadvantage is that they do not have the ability to tell the information from friend to
foe. Users inside may have a harmless activity which will lead to lockdown to the network. It
will be as same as locked until an undetermined amount of time. The professional has to be
available all time to identify and reset the threat. For a business class people, this can cause a
drastic loss of revenue an client confidence, as any of companies partner may take business
elsewhere to a company with a reliable network (PeymanKabiri and Ali A.Ghorbani, 2005).
1.7 AIM AND OBJECTIVES
 The main aim of this project is to find out that whether the organizations have
enough security measures to protect or prevent the information and data from
cyber-attacks on the World Wide Web.
 The main objectives for selecting this project are to find out whether the
available security standards and security practices are capable to protect the
organizational data and information from security threats and attacks.

1.8 BACKGROUND AND MOTIVATION
Cyber trap products nowadays installed in the private and public sectors all over the
world. Cyber trap products mainly applied to analyze the big data for monitoring the traffic in
the network and provide visibility on both the end of the network of the organizations. It also
provides a plan for the organization to show how they can secure their data and information.
Also, the cyber trap system is going to provide the information about IP and other suspicious
activities of the user as well as a system administrator. The cyber trap technology is going to
support the different type of technology among currently available technologies in the market
and from another different type of security threat situations.
1.9 PROBLEM
Nowadays, different types of organizations that have daily multiple types of traffic
generations at the applications level and from another different type of security threats use a
cyber trap to protect their network. Different types of security threats are possible so that most
of the largest global organization uses cyber trap methods to manage and secure the
information and identities as well as their technology infrastructure.
1.10 PROPOSED SOLUTION
Cyber trap is the leading solutions that can provide security to loss of data and
information over the system network of the organizations.
1.11 STRUCTURE OF THESIS
The thesis starts with the chapter 1.Introduction of next generation cybertrap for the
corporate. In chapter 2.Literature review about the intrusion prevention and detection are

surveyed. In chapter 3. Technologies used in the intrusion detection and prevention systems are
explained. In chapter 4. Design methodology used in the system is briefly explained. In chapter
5. Approaches used in the intrusion detection and prevention systems are illustrated. In chapter
6. Implementation of design is described. In chapter 7. Conclusion and future work of the
project is described.
1.12 SUMMARY
Next Generation Intrusion Prevention System is also called as Intrusion Detection and
Prevention System (IDPS) where the cyber trap is implemented in the corporate for improving
its safety and security. Even though there are many security applications in the enterprise they
need additional security that to be implemented. The report is based on the explanation of
different mitigation methods or techniques that are used for storing the information and data in
the secure network system.

CHAPTER 2
LITERATURE REVIEW
2.1 INTRUSION PREVENTION AND DETECTION IN NFV
In this paper, they focused on Intrusion Detection Systems (IDS) and Intrusion
Prevention Systems (IPS), where it is designed for monitoring and detecting the malicious
software and unwanted actions that attacker try to compromise, modify the computer system..
They stop or dismiss them at their happening time and describe with the brief outline of IDS or
IPS and their typical applications and then precisely discuss NFV-based implementations
(panelZonghuaZhang, AhmedMeddahi, 2017).
2.2 INTELLIGENT INTRUSION DETECTION SYSTEM FEATURING A VIRTUAL
FENCE, ACTIVE INTRUDER DETECTION, CLASSIFICATION, TRACKING, AND
ACTION RECOGNITION
An intrusion detection system (IDS) is mainly used to protect nuclear power plants
against exterior threats, namely sabotage and various malicious attacks. Still, an operator
constructs previous versions of IDSs to spot an intruder from the pictorial review. It has the
difficulties of needful reserve human resources and trusting on capabilities of the operator. Here
they proposed an image-based intelligent intrusion detection system (IIDS) with a virtual fence,
recognition the motion, active intruder detection, classification, and tracking to solve these
limits. An integrated gaining device was factory-made joining optical and thermal cameras to
recompense for the drawbacks of optical cameras, major trouble in detecting an intrusion at night
time, under argumentative weather conditions.The virtual fence has a purpose to establish the
border between surveillance and exterior areas in a graphical user interface and to describe an
early pre-alarm area if essential. The contextual model is calculated to sense moving objects and

sensed objects are segmented into bounding boxes. The proposed IIDS helps to meet the
protection requirements suggested in the nuclear controlling guidelines. It is predictable to do
more lively and consistent intrusion detection in mixture with existing sensors, such as electric
fields, and fence disturbance sensors, microwaves in a nuclear power plant (Seung HyunKim. et
al, 2018).
2.3 A NOVEL HONEYPOT BASED SECURITY APPROACH FOR REAL-TIME
INTRUSION DETECTION AND PREVENTION SYSTEMS
In this paper, the author describes the honeypot based approach for intrusion
detection/prevention systems (ID/PS). In this paper, they have developed an honeypot server
application which is shared with IDSs to analyse data in happening-time and to function
efficiently. Furthermore, by correlating the rewards of the interaction of honeypot with low and
high parameters, a superior hybrid honeypot system is achieved. The proposed system is a
honeypot based intrusion detection and prevention system (IDPS) type and it is intelligent to a
demonstration of network traffic on visualizing the real-time animation servers and also it offers
the system data effortlessly. In conclusion, the system which is developed is used to find a zero-
day attack because of Intrusion detection system configuration. This gives more advantage in
finding the low positive level in the Intrusion Detection Systems. The virtualization technology
and corporate networks are used to reduce the configuration cost, maintenance cost and system
management are done effectively (panelMuhammet, Baykara ResulDas, 2018).
2.4 TRUST AWARE SUPPORT VECTOR MACHINE INTRUSION DETECTION AND
PREVENTION SYSTEM IN VEHICULAR AD HOC NETWORKS
The author mainly focused to improve safety and security on the road by using Vehicular
Ad Hoc Networks (VANETs) to provide various benefits to travellers. Though VANETs is a

wireless type of communication network, it is traditional to use frequent security adventures that
exist in the environment. They also provide preventive methods are fine as receptive resolutions
for network intrusions for monitoring and detecting potential intrusions that are continuing in the
network. Live network bouts are usually calculated to decrease or suspend the accessibility of the
network. The outcome of these attackers on the network can be identified by selecting
parameters, it turns to be used as the main role for spotting malicious activities. Here they
proposed full IDS in VANET by combining data collection method and Support Vector Machine
(SVM) techniques for analysing the data to create the trust among the values in all vehicle on the
networks as named Trust-Aware SVM-Based IDS (TSIDS) (panelErfan A. et al, 2018).
2.5 AN ANOMALY-BASED INTRUSION DETECTION SYSTEM IN PRESENCE OF
BENIGN OUTLIERS WITH VISUALIZATION CAPABILITIES
The author focused on the Abnormal network traffic examination using Intrusion
Detection Systems (IDSs) and visualization techniques has significantly converted vital research
area to defend computer system from the intruders. It makes very challenging to plan a precise a
vigorous IDS with visualization abilities to determine cyber threats owed to the large value of
network traffic. In this work, they introduced and described a novel anomaly-based intrusion
detection system in the happening of high-range independence data called benign outliers.They
use neural forecast architecture by a modified Self-Organizing Map (SOM) to sense attacks but
also to give a report about the identified attacks with accurate evidence to the end users. The
newly proposed method allows healthier examination by integration of a core value of network
traffic into a simple way to understand the format in 2Dand a modest user communication.The
data has been tested by using the benchmark datasets (NSL-KDD, UNSW-NB15, AAGM and
VPN-non VPN) that can be applied in this domain (panelAminKarami. et al, 2018).

2.6 ATTACK DETECTION/PREVENTION SYSTEM AGAINST CYBER-ATTACK IN
INDUSTRIAL CONTROL SYSTEMS
Industrial control systems (ICS) are very important for industrial facilities and critics.
Since it is not sufficient for security test and evaluations against the security attacks they need to
prevent the data in the ICS. Every day they are exposed to the new threats. So they must be
protected against the intruder in order to secure the infrastructure to protect the data and the
information. So preventing the data has become more significant other than preventing it. So in
this paper, they have carried out a research on the weakness and types of detection that is
possible in the system. Programmable logic controllers do it and it is very important in ICS. To
stop the attack rules and principles are created. With the help of the rule table, the previous
attacks can be prevented without making any harm to the business. Finally, the analysis showed
that this way reduces the attacks in the systems. The system is tested using PLC devices (Ercan
NurcanYılmaz, SerkanGönen, 2018).
2.7 DENDRON: GENETIC TREES DRIVEN RULE INDUCTION FOR NETWORK
INTRUSION DETECTION SYSTEMS
The author describes the Intrusion detection systems (IDSs) are extremely important
things/businesses in a network topology aiming to safeguard the (honest and good
quality/wholeness or completeness) and availability of sensitive valuable things in the protected
systems. In misuse detection systems, in this paper major purpose, the detection process depends
on clearly stated on particular attack signatures rules in an effort to tell the difference between
legal/real and true and evil and cruel network traffic. Generally, three major challenges are
related to any IDS of this category: identifying patterns of new attacks with high (quality of
being very close to the truth or true number), (making better) the human(the ease of reading

something) of the detection rules, and rightly selecting/naming the category these attacks belong
to. To this end, we propose Dendron, a way(s) of doing things for creating new detection rules
which can classify both common and rare types of attacks. Our way(s) of doing things takes
advantage of both Decision Trees and (related to tiny chemical assembly instructions inside of
living things) Sets of computer instructions for the benefit of changing (and getting better)
(language-related) understand/explainable and (very close to the truth or true number) detection
rules. It also (combines different things together so they work as one unit) (experience-based
thinking) methods in the (related to things slowly changing for the better over time) process
aiming to deal with the challenging nature of the network traffic, which generally biases machine
learning ways of doing things to neglect the minority classes of a dataset. The experimental
results, using KDDCup'99, NSL-KDD and UNSW-NB15 datasets, show about that Dendron can
(accomplish or gain with effort) superior results over other (the best design available now)
(something given to future people) ways of doing things under (more than two, but not a lot of)
classification numbers that measure things, while at the same time can significantly detect rare
rude (because of getting personal) events (panel Dimitrios, et al. 2018).
2.8 A REAL-TIME ANOMALY-BASED IDS FOR CYBER-ATTACK DETECTION AT
THE INDUSTRIAL PROCESS LEVEL OF CRITICAL INFRASTRUCTURES
In this paper, they proposed an anomaly-based intrusion detection system which helps to
find the critical condition of the organization. The algorithm is created based on the two phases.
At first, they learn the identical behaviour of the system process and it is detected for the
intrusion behaviour. If any misbehaviour is found then it rises an alarm finding the irregular
performance of the system. The main aim of this research is to detect the attacks in the network
devices with the critical organization process. They proposed a new IDS to grab the complex

problems of monitoring the data by Industrial Control System. Finally, it is tested and validated
using a detailed report that is obtained on a management plan (panelXavier, et al. 2018).
2.9 AN EFFECTIVE AODV-BASED FLOODING DETECTION AND PREVENTION
FOR SMART METER NETWORK
In this paper, the author investigates the overflow attack and prevention method in a
smaller network. The default Adhoc On-Demand Distance Vector (AODV) protocol is at risk of
overflow attacks because of midway meters forward packets recklessly. For sensing and
preventing the system from the attack, they proposed a new protocol for overflow attack called
AODV-based routing protocol.They keep in mind about the IP spoofing. If IP spoofing does not
exist then the direction of the request is changed by adding new features. The main idea used in
this approach is to give permission to the one-hop neighbour meters to identify the attackers. The
results are collected by the meter and it regulates the system by a one-hop neighbour to source or
not. If it is true then the meter updates with the request counter when they receive each request
from the source. By using this way the receiver can prevent the attacks without an IP spoofing.
If IP spoofing exists then the protocol hides an original IP address. Here the algorithm becomes
more complex and include the trust of neighbours in the table. When the request is continued
then it is rejected by the protocol. The whole process is implemented using the NS3 simulation to
show the performance of the proposed algorithm (panelMd RaqibullHasan et al. 2018).
2.10 A SURVEY ON INTRUSION DETECTION SYSTEMS AND HONEYPOT BASED
PROACTIVE SECURITY MECHANISMS IN VANETS AND VANET CLOUD
Here the author describes the Vehicular Ad-hoc Network (VANET) is an emergent
category of Mobile Ad-hoc Networks (MANETs) through outstanding applications in the
intellectual traffic structure. Applications in VANETs are lifetime critical subsequently hominoid

lives are at pale and consequently, communication between nodes (vehicles) must be recognised
in the most protected manner. To afford security for VANETs, several security methods are
planned, the further most widespread of which is Intrusion Detection Systems (IDSs). IDS has
previously proved its value in the detection of malicious nodes in old-style networks but
smearing the IDS in VANET identical networks is in some way different and challenging due to
its abnormal characteristics such as resource-constrained nodes, the high mobility of nodes,
specific protocols stacks, and standards. Here the author presents a brief summary about the
numerous IDSs, in wide-ranging, to catch the readers well familiar with the idea of IDS
subsequently which a painstaking survey of various IDSs that are propounded for VANETs is
put advancing shadowed by analysing and associating each technique along with advantages and
disadvantages. Approximately simple instructions to be presented for increasing IDSs that have a
potential application in VANET and VANET cloud. The major aim of the author is to identify
foremost trends, open challenges, and upcoming research directions in the placement of IDS in
VANET (panelSparshSharma, AjayKaul, 2018).

CHAPTER 3
3. TECHNOLOGY
In today’s business world, cybersecurity is a critical issue. It is the protection of computer
systems from disruption or misdirection of the services. It refers to the structure of technologies
and processes which is designed to protect networks, devices, data and programs from attacks or
unauthorized access. Cybertrap is the next evolution of cyber security which offers an advanced
level of deception technology. It traps malicious access into its digital environment. The Next-
Generation Intrusion Prevention Server (NGIPS) provides protection from threats that blocks
intrusions and safeguards the things which are valuable. Also, Next Generation Intrusion
Detection Server (NGIDS) will detect the vulnerabilities occurs in the networks and devices.
Some benefits of Next-Generation Intrusion Prevention Server (NGIPS) are (PeymanKabiri and
Ali A.Ghorbani, 2005).
1. It will detect intrusions in which traditional Intrusion Prevention Servers can’t see
2. It has 30% faster Resolution time
3. It will increase the Analyst Efficiency
4. It will shrink your security stack
5. Also adapts as your needs change
3.1 INTRUSION PREVENTION SERVER (IPS) VS INTRUSION DETECTION SERVER
(IDS)
IDS and IPS servers work under both network-based and host-based. The problem with
intrusion detection servers it doesn’t stop the attacks from happening. It will only detect the
attacks that are happened in the network. But the intrusion prevention server will identify the

attacks and stops it and also prevents from its happening. Intrusion detection system is just like
an alarm to detect the attacks and potential threats which occur in the network or host. It will
raise the awareness for the users. The intrusion prevention server (IPS) is similar to an intrusion
detection server (IDS), except that it can protect from attacks and blocks from potential threats.
The IDS can monitor, log and report the activities, likewise, IPS has the capability of stopping
threats without anyone getting involved. If an IPS is not working properly, it can create more
traffic in the network (PeymanKabiri and Ali A.Ghorbani, 2005).
3.2 NEXT GENERATION INTRUSION DETECTION SERVER (NGIDS)
The Next Generation IDS is to detect a wide variety of network-based attacks such as
Malware attacks, worms, web attacks, scan attacks, Brute force attacks, Denial-of-service attacks
etc. It monitors traffic and system events and determines whether an event is an intrusion or not.
3.2.1 Requirements for an NGIDS
 Behaviour-based analysis
 Abdication of a learning phase
 No payload evaluation
 Network-based evaluation and use of agents
 Cross-evaluation and distribution
 Active and automated prevention
3.3 NEXT GENERATION INTRUSION PREVENTION SERVER (NGIPS):
The next generation intrusion prevention servers (NGIPS) take a boom in the years
between 2011 and 2015. These technologies have emerged as a minimum baseline control for the

internal network. It includes the features like user control and application. It provides wide
coverage of network communication protocols to detect various kinds of attacks and application
to set the limited services of an application about the usage of the users. Also, it provides user
control, to allow a limited number of people to access the application. It also includes extensive
coverage of network protocols, contextual awareness and content awareness. It performs
advanced threat protection and actionable threat intelligence on sperm, phishing, malicious
websites, malware detections, embedded IP-based and etc. It also integrates with sandboxing
analysis which is an important feature included in NGIPS (PeymanKabiri and Ali A.Ghorbani,
2005).
3.3.1 Key Components
Some of the key components that differentiate NGIPS from traditional IPS are Threat
Intelligence, Application Control, Intrusion Prevention System and some form of File analysis
engine. These will work together to form multiple layers of specialized control. A good NGIPS
will provide protection and relief from the immediate need to patch affected systems. The
NGIPS must catch refined attacks while producing as few false positives as possible
(PeymanKabiri and Ali A.Ghorbani, 2005).
3.3.2 Use Cases
Some of the use cases that are included in NGIPS are
 Effectiveness, performance and openness
 Compliance and Segmentation Security
 System Hardening
 Protecting Dynamic Workloads

 Separation of Duties
3.3.3 Features and advantages
 On-time Contextual Awareness
 Advanced Threat Protection
 Global threat intelligence
 Intelligent security automation
 High-performance appliances
 Networking and security features
 Scalable protection
 Simplified Threat Management
3.3.4 Technologies and Resources
Server intrusions are now become to be a very normal thing in the day to day life.
According to the recent survey, it is found that the industries are getting affected by phishing
attacks and now another new intrusion is expected to spoil around 9billion by the end of 2018.
Below are the various types of security tools which are used in IDS and IPS to find the third
party intrusions before they damage anything.
3.3.4 .1 McAfee Network Security Plan:
This network plan offers you to block any type of malware and also helps to target the
advanced attacks on the network. This provides an extended protection beyond the IPS signature
mapping technique with a signature-less technology which fights against the new intrusions. This

provides prevention and threat solution to protect both system and data of the organization in
their data warehouse.
McAfee Network Security plan could be defined by a reference guide – “ Network Security
Platform Quick Tour” which helps you to understand the overview of how to use and manipulate
NSP policy.
Intrusions of any third party will first get your basic details of credit card and send you unwanted
programs and the intruders will launch attacks via the internet and inject Trojans into your
system to hack all the confidential data. This security plan will protect the data from any kind of
network intrusions that is happening to your system or organization.
3.3.4.2 Trend Micro Tipping Point
TippingPoint IPS have offered a very good protection against threats and evasive targeted
attacks with high accuracy. Using techniques like deep packet inspection, threat reputation and
malware analysis, this provides an effective way of security. This mainly used to pinpoint, track
and block the suspicious activities that are prevailing in the network to stop the free movement of
the malware and ensure that the available network enhanced its performance. This could be
installed without IP address and it is easy to remove the suspicious activity prevailing in the
system. This normally gives protection to the entire network system and making it away from
intrusions. This is considered to control or monitor the incoming and outgoing network traffic
from different countries (PeymanKabiri and Ali A.Ghorbani, 2005).
This is also considered to have high standby capability in prevention. Appliance failover is
complete without any manual intervention. This provides rate shaping to prioritize traffic flows
in the network.

Deep security prevention will also have a threat intelligence which will have a track on the
threats which are prevailing in the network and also have cloud integration to have a detailed
description of the software attack and its IP details.
3.3.4.3 Darktrace Enterprise Immune System
Darktrace Enterprise Immune System was inspired by a human immune system which is
an AI basically. This new class of technology will help the organizations to protect themselves in
a different fundamental way by providing new techniques which are followed in machine
learning. The main advantage of this is that the attacks are noted automatically and it is not
required any previous experience in potential threating. This works automatically with
knowledge or sign, when attacked to intrusion, it will automatically raise walls against them.
This method is considered to be innovative as it deals with a number of issues. As it does not
have the habit of capturing the existing attack or threat, i.e“ no known threat”, this does not
detect existing known attacks. This method is widely used across large enterprises
(PeymanKabiri and Ali A.Ghorbani, 2005).
3.3.4 .4 NSFocus
NSFocus offers a wide range of network security to large enterprises and also helps in
providing a solution to network threats. This offers a hybrid distributed denial of service (DDoS)
which is widely used by all organizations. This also helps in protecting the system or server or
network from advanced persistent threats (APTs). The products from NSFocus are majorly
concentrated on threat intelligence so organizations are empowered with a smart and simple way
of attaching detection. They also provide services on a long-term scale for the protection of

organizations data. They provide a server for almost 8000 plus customers all over the world. This
will maximize the availability and security and trust made to the threat detection activity.
They also have products which detect the traffic which is prevailing in the network. They also
provide threat protection services as all the products are oriented to detect threats. They discover
and block the intrusions happening in the network. They also give security feature which will
help you to be online and also helps in traffic prioritization and shaping to ensure bandwidth for
crucial customers (PeymanKabiri and Ali A.Ghorbani, 2005).
This monitors the overall traffic by collecting and analyzing the traffic data. This helps the
networks to enable the network administrators to have a programmatic approach to the traffic
load and trends to use the network application resources. This monitors the traffic by defined
subnets and key servers.
This will provide them with a detailed information about the data which are analyzed from the
total traffic volume. Correlation analysis will be performed for objects which are of different
dimensions and in order to provide clarity of the network composition. With a very minimum
granular analysis of about 30 sec, it is capable of reflecting and detecting the network traffic
prevailing in real time. This system prevention also provides analysis on data storage for a year
or so. They generally rely on long-term data or analysis on a historical data. This can track the
traffic distributed across the network in specific with time, region and the direction of flow. This