Intrusion Detection System Research Proposal: A Switching Domain Focus

Desklib provides past papers and solved assignments for students. This report explores Intrusion Detection Systems in switching networks.

INTRUSION DETECTION
1

Abstract
Intrusion Detection System is being adopted readily in the present corporate world to prevent
attacks on the network and identify the causes. It can also act as a risk assessment tool to gauge
the effects of attacks and formulate ways on how they can be overcome. The report presents the
research proposal for carrying out a research on Intrusion Detection System based on switching
The introduction and background will provide a brief overview on the topic and how IDS
developed through the ages after its introduction in the 1980s. The Research aim and objectives
will also be highlighted based on the research questions. The literature review will provide some
insight into the theories and models as provided by various researchers. The research
methodology will highlight the way the research will be conducted following the Research
Onion. The proposal for the research will also be provided by using a Gantt chart.
2

Table of Contents
Introduction......................................................................................................................................4
Background......................................................................................................................................4
Aim of the Research........................................................................................................................5
Objectives of the Research..............................................................................................................6
Deliverables.....................................................................................................................................6
Academic Challenges......................................................................................................................6
Professional and Ethical Issues........................................................................................................7
Outline Literature Review...............................................................................................................8
Concept of dependent and independent variable.........................................................................8
Host-based Intrusion Detection System.......................................................................................9
An application-based intrusion detection system.......................................................................10
Network-based intrusion data systems.......................................................................................11
Methodology..................................................................................................................................12
Introduction................................................................................................................................12
Research onion...........................................................................................................................12
Research Philosophy..................................................................................................................13
Research Approaches.................................................................................................................13
Project Plan....................................................................................................................................15
Conclusion.....................................................................................................................................15
Reference List................................................................................................................................16
3

Introduction
Intrusion Detection System is used to monitor a network and protect it from external
Attacks. With developing technology, IDS has to be considered seriously by tech companies.
Several businesses, organisation, financial firms, industry makes use of Local Area and Wide
Area Networks. These networks become a target for intruders that are trying to gain access to
company data or client information. Hackers and Malicious Users use the networks and cause
vulnerabilities in the form of bugs, resetting the configuration of the system to default and
Administration lapses. Hackers nowadays also are developing worms and viruses to attack
systems. Several methods are readily available on the web which teaches hacking, password
cracking and encryption breaking. Therefore, adequate security is needed to help protect the
systems. Basic systems nowadays use firewalls that protect private networks from public
networks.
Intrusion Detection is the process that analyses the occurred events in a computer network
system and then determines the probable intrusions that may have taken place in the system. The
detection system is used to identify the incidents by attackers, monitor them, terminate them and
produce a log that is made for the security administrators. This research proposal will highlight
the background for Intrusion Detection System and focus on the issues. The aim and objective
that the research aims to achieve will highlight the questions and purpose of the paper. The
literature will discuss and touch upon the literature that is already present and some theories
regarding various systems. The research plan will also be shared for carrying out the original
research. A proper outline for the final research will be given that will aim at achieving the
research objectives and result.
Background
Intrusion Detection System is used to monitor the system network for identifying misuse
Moreover, anomalous behaviour. The concept of Intrusion Detection was first given in the 1980s
when the internet came into existence. This called for periodic monitoring of the network. There
was a rise in the incorporation and reputation of the network security infrastructure (Allwood et
4

al. 2016). Now, the present IDS systems are much more improved than its previous versions.
James Anderson, in 1980 first published a paper on Computer Security and threat monitoring and
Surveillance that laid
the foundation for IDS development. Somewhere around 1982-1986, Peter Neumann and
Dorothy Denning started worked on a Government project based on developing an IDS. They
were the ones responsible for developing the first real-time model. Nowadays the frequency of
online attacks has increased by huge margins (Anwar et al. 2017). Development of technology
also has made available tools that can be used easily to hack and intrude a network system. A
study showed that between 2006 and 2010, the attacks related to cyber systems increased from
5000 to
almost 35000. So there is a dire need to understand the importance of such systems and make it
more applicable. Advances in technology mean that the ways to tackle the problems have also
increased. Only useful research, analysis and development of tools are needed to solve the
problems. (airccse.org, 2019)
Aim of the Research
The research is aimed at understanding the importance of intrusion detection system in the
switching domain. The intrusion detection system is used to control the security of the network
and thus monitor and terminate the problems and security problems. The research will highlight
the types of attacks that can take place in a network. Some of the attacks that will be discussed
are the DDoS attack, SNS attack, Ping of Death, Spoofing attacks, application-level attacks and
so on. The research will also aim at understanding the IDS concept and the different types of
present models. The advantages and disadvantages of all the models will also be shared. The
types of intrusion detection such as anomaly based and signature-based will also be discussed
(Banerjee et al. 2019). The function of IDS, its life cycle and how it can be deployed and
maintained will also be highlighted. The differences between the vulnerabilities and exploits will
also be highlighted. The IDS in a switching domain will be dealt with in the analysis, and the
pros and cons of the system will be shared. The research is aimed at providing future researchers
with good literature on the topic that can act as a guide to carry forward their research. Presently
many organisations face the effect of such attacks, and sensitive data are leaked online. This
5

harms the company both financially and strategically. The research will help gain a practical
perspective and knowledge about such attacks. The cases will also help gain insight on how the
problems were tackled and what steps are being taken by organisations presently to limit and
prevent such form of attacks. Upon conducting the research, the researcher will gain insight as to
how the IDS system can be used to solve the security level problems present in the industry.
Objectives of the Research
The main objectives that the research aims to achieve are:
 To understand the concept and theories regarding the Intrusion Detection System.
 To know the urgency of the problem and why IDS needs to be adopted.
 To understand the advantages and disadvantages of an IDS and its various models.
 To know the various types of attacks that can harm a network system and how they can
be tackled.
 To know how IDS can be deployed and applied practically.
 To provide some recommendations as to what can be done to adopt IDS swiftly and
rapidly.
Deliverables
The report is aimed at providing a research proposal as to how the main research will be carried
out by outlining the structure and the plan-setting for the research. The research will use real-life
cases and use various theories and models related to the Intrusion Detection System to achieve
the research objectives and answer the research questions. The research will help the researcher
gain knowledge about the usefulness of IDS in a Switching Domain and know about the
characteristics, advantages, disadvantages and applicability of the system.
6

Academic Challenges
The academic challenges are the problems that are faced during Academics. The challenges that
can be faced by the researcher academically can hamper the outcome of the research. However,
care will be taken to limit the effect of the factors on the research outcome. The researcher will
research the best of his/her ability to achieve the research goals.
Some of the challenges that can be faced are:
 Content Understanding- Some of the research terms that will come across may be
difficult to understand for the researcher due to lack of experience. The content in the
resources may require a higher level of understanding that the researcher currently
possesses. To adapt to the changes may prove challenging for a researcher.
 Balancing Time- The researcher being a university student can find it challenging to
balance time for studies and to carry out the research. The credits that are present for
some courses may influence the researcher to prioritise others than this course. Self-study
time needs to be also taken into consideration as such higher level study requires a
massive amount of self-assessment sessions (Boero et al. 2017). The researcher can also
find it difficult to manage personal time and study time that is necessary to maintain a
healthy lifestyle.
 Lack of Motivation- A lack of clear goals and objective can also demotivate the
researcher. The effectiveness of the course and its lack of future applications can also act
as a cause for demotivation. Lack of resources and difficulty in understanding can make
the researcher lose interest in the research. The effect of other courses also may force the
researcher to research a very lack-lustre way.
 Classmates and Peers- The effect of peers is a significant factor that can act as a
challenge. Finding peers and classmates who can help is quite tricky. The social aspect of
college life affects the mindset of the students and hence shapes how he/she tackles
problems. The negative aspects of having the wrong kind of peers also cannot be ignored.
Professional and Ethical Issues
Carrying out the research includes following a set of rules and regulation that govern proper
research (Chiesa et al. 2017). The researchers maintain the integrity of the research by following
the given set of code of ethics. However, the research can face some ethical issues. Care will be
7

given that the code of ethics while conducting the research are maintained and followed. The
data presented in the research will be conveyed honestly, and all the data, results and objectives
will be carefully portrayed. The researcher will maintain the originality and integrity of the data
shared, and no type of exaggeration will be done. The research will try to avoid any biases and
the research will be conducted with objectivity. Care has to be taken that the research outcomes
do not affect the researcher financially or personally. The researcher will conduct the research
carefully and try to avoid any mistakes. The work will be reviewed after being done and opinions
of peers will also be taken. The researcher will present the data and share the results openly with
any interested party. All the journals, books and articles that will be used for this research will be
carefully referenced and given credit. The researcher will maintain the integrity of the report by
avoiding Plagiarism. Plagiarism is an offence in the research world and the researcher will
respect the copyright of researchers. During conducting the research, no harm will be done to
animals or any private or public property. The research will also not harm any human interest
and people. The research is aimed at benefiting the people as well as the participants of the
research. The research will follow the guidelines as a present by the ethics committee of the
university and adhere by the code. The research will be carried out keeping all the factors in
mind and hope to deliver fruitful and authentic research.
Outline Literature Review
Concept of dependent and independent variable
The research is done to analyse the current situation of the switches in the domain. These
switches are the one which determines the intrusions. The intrusions can be coming from the
outsiders as well as the insiders. As per (Harang and Kott, 2017), the detection of the intrusion
occurs at different memory levels on the networks. These networks contain a considerable degree
of strong memory along with burstiness. These are related to the systems of the computer
(Declerck et al. 2017). The computers can be intruded through a variety of insiders along with
the outsiders. The dependent variable for the research will be the domain issues regarding the
detection of intruders.
8

The independent variables for this study will be the scientific risks associated with intrusion
detection (Yadav et al. 2019). These scientific risks or the influencers affecting the switches are
the environments related to the operations of the systems, costs mistaken and prior probabilities
for the intrusion. There are specific types of systems for detecting the intrusions. The systems are
single intrusion detection systems and multiple intrusion detection systems.
(sciencedirect.com, 2019)
As per (Ajaeiya et al. 2017), the networks made by the use of software can be attacked much
easily. The popular networks, on the other hand, cannot be attacked easily. The computers can be
abused by the different kinds of intruders present inside or the outside. The research includes the
switches or the issues of the domain while detecting any intrusions. The dependent variable will
be the switching domains which are the hot based IDS, Application-based IDS and network-
based IDS. The host-based IDS is installed locally. The intruders can be caught in this part. The
Application based IDS test the protocol along with the behaviours. The behaviours will be
active and this type of intrusion detection system checks the different types of behaviours and
the events occurring in the protocol. (arxiv.org, 2019)
Host-based Intrusion Detection System
The system is formed in such a way, the intruders generating locally can easily be identified and
can be captured. There is a certain kind of logging system as a host and some information are
provided inside it to capture the intruders. These form of the system acts as a sensor ( Sultana et
al. 2019). There are mechanisms present inside the creation of the logging system. The
mechanisms are used for the generation of data or information (Gehrke et al. 2017). The sensor
present in this kind of system for the detection of the intruders collects data from a variety of
sources. These sources can be like the system logs or the operations assisting in the generation of
different processes of the system.
There is the presence of an audit system. This system includes the operation of the systems and
does not show the contents present inside the objects. There is a high level of trust generated
from the hot based system on the trail of the audit (Harlacher et al. 2017). The data or the
information present inside these systems and by having a high level of trust on the trail of the
audit, the hot based system can easily identify the intruders and thus making it easy for the subtle
patterns to spot. These patterns of subtle manner are misused and are not visible at the level of
abstraction present at a high level (Kleinmann and Wool, 2016). These kinds of the detection
9

system are much more useful than the other types of detection systems like the network-based
system. Much more relevant information can be found in this kind of detection system. The
risks associated with this kind of detections system is much less than the other systems. This
system properly analyses the detection and tends to identify all of the information regarding the
attacker. When an intruder tries to attack the computer, the intruder tends to use commands and
specific stuff. The host-based system identifies all of the commands utilised by the intruder
while attacking along with the files opened. This system gives all of the information about the
tasks done by the intruder. (core.ac.uk, 2019)
Figure 1: Intrusion Detection System
(Sources: Created by author)
An application-based intrusion detection system
The protocol has certain types of events associated with it. These events are linked to specific
behaviours. The application-based intrusion detection system checks all of the events along
with the behaviours. The behaviours must be effective ones as this system identifies or checks
only the effective behaviours linking the protocol. The application-based intrusion detection
system is placed in between the processing part and the group of linked servers. After the
placement in between the group of servers and the processing part, the monitoring is done along
with the analysis. The monitoring assists in the analysis of the protocols present in between the
10
Intrusion
Detection
System
Network
based IDS
Application
based IDS
Host based
IDS

devices (Lopez and Duarte, 2016). It is to be kept in mind, the analysing of the protocols are
done to those which are related to the application. Some of the attacks are made in order to affect
the organisation.
These attacks are harmful and are known as intentional attacks. These kinds of system help in the
detection of harmful or intentional attacks (Ren et al. 2016). Sometimes the intruders want to
harm the organisations internally by deleting important files (Nguyen et al. 2017). These files
include all the kinds of financial transactions occurring in the organisations. These files are
crucial because these files help the organisations to specify the goals as well as the growth of the
company. These attacks are not intentionally done causes harm to the organisation by deleting
the important financial files (Shaghaghi et al. 2017). The attacks which are not intentional, as
well as the intentional attacks, can be detected with the help of application-based intrusion
detection system. (patentimages.storage.googleapis.com, 2019)
Network-based intrusion data systems
The research will include this kind of intrusion data system as well. The way these systems are
harmed or the way these systems are utilised in detecting the intruders will be discussed in the
research. The network-based intrusion data system does not go on to collect the data or
information from any other hosts (Manès et al. 2018). This system tends to collect the
information by itself only. The audits of the network-based intrusion data system attack when
the packets are moving throughout the network. The sensors of the network come prepared with
the signatures of attacks. These kinds of signatures define the types of attacks associated with
particular rules (Naiksatam et al. 2017). The systems of the type network based allow the expert
users to determine their type of signatures for the detection of the attacks. Any attack occurring
on the sensor can be linked with the signatures. For the purpose of recognising any attacks done
by the intruders, it is significantly important to make the operations occurring in the monitor
transparent (Nobakht et al. 2016). The transparency forms concerning the users. The attacks
occurring on the sensors are mainly linked with the signatures used previously. These signatures
are the attacks.
The monitor having the transparency tends to decrease the likelihood of an antagonist. This kind
of antagonist formed can be easily located. The creation of transparency helps in search of these
locations. The primary offering of help comes through this process of locating the antagonist.
The help happens because of the process as it nullifies the capabilities of the attacker without the
11

usage of the efforts. The agents of the network-based intrusion data system can be deployed at
every host where the protection of the network is necessary.
Methodology
Introduction
The methodology will be dealing with the way, this research needs to be followed. It is known to
the researchers that a certain level of directions is required in order to complete research. If the
sensor can be recognised for completing the project by meeting the objectives properly then it
becomes easy for the researcher to complete the research. In this section of the chapter of
methodology, the different types of approaches will be discussed along with the process selected
by the researcher to complete the research (Uman, 2017).
The philosophies of different kinds of researches are also discussed along with the philosophy
utilised in this research by the researcher. The certain type of methodology followed by the
researcher in this study is the
Secondary method of research will be followed. The goals will be set as per the research and
the process followed by the researcher will be based on research onion. This method will be used
in this study as most of the ideas are taken from a variety of researches on this topic earlier. All
of the ideas taken from different kinds of sources are related to the topic. The main reason for
selecting a secondary method of research is the availability of time. There was not enough time
available to the researcher to do the primary research, as well as the primary method of research,
would have been more costly.
Research onion
The Research onion is crucial for any kind of research. A proper sense is identified in the theory
of the research onion. It includes a variety of processes which can be taken up by the researcher.
The researcher selects the processes on whatever seems useful. The research onion will give
specific information about the steps. These acquiring of the steps are essential as it can assist the
researcher in achieving the outcome as well as the objectives of the research. The MNK
Saunders first gave the idea about this. It has been useful to all the researchers in the past. The
critical part of the structure of the research onion is its layer present outside. From the beginning
of the outermost layer, the author tends to follow particular steps. While following the steps the
12