Next-Generation Cybertrap for Corporate Intrusion Prevention Systems

This project proposal examines the implementation of a Next-Generation Cybertrap for corporate intrusion detection and prevention servers within enterprise businesses. The abstract introduces the concept of Intrusion Detection & Prevention Systems (IDPS) and their role in monitoring network activities and mitigating cyber threats. The proposal outlines the aims and objectives, focusing on evaluating existing security measures and the capabilities of security standards in protecting organizational data. The introduction elaborates on the increasing vulnerability of networks and the importance of IDPS in identifying and responding to threats. The literature review highlights the growing concerns around data security, ethical issues, and the need for advanced security measures. The technologies and resources section discusses various IDPS providers like McAfee, Trend Micro, Darktrace, NSFocus, H3C, Huawei, and Cisco, detailing their features and functionalities. The proposal aims to explain mitigation methodologies used by corporations to protect their data, and to discuss IDS product benefits and technologies. The project intends to provide knowledge about security standards and methods to protect data and information from external and cyber-attacks.

Project Dissertation Proposal
Title:Next-Generation Cybertrap For Corporate Intrusion Detection Servers and
Intrusion Prevention Servers in Enterprise Business.
By:
Supervised by:

Table of Contents
Abstract
Aim and Objectives
Introduction and Background
Literature Review
Technologies and Resources
Methods and Work plan
Ethics Aspects
Conclusion
Reference
2

Next-Generation Cybertrap For Corporate Intrusion Detection Servers and
Intrusion Prevention Servers in Enterprise Business
Abstract
Next Generation Intrusion Prevention Systems is also term as Intrusion Detection & Prevention
Systems (IDPS). Here we can see that Next Generation Cyber trap for corporate intrusion detections
server and intrusion prevention servers in Enterprise business that consists of different network
security applications which monitor the network and suspicious activities in the system. This system
is going to protect the business from existing and upcoming attacks as well as provides regular
control over the system and preventing from cyber threat. The expertise of Next-generation
intrusion prevention system helps in protecting the important data and information as well as
applications from most advanced cyber-attack without harming the enterprise production and its
system performance. Our project is mainly focused on explaining the different mitigation
methodologies or techniques used by corporate for storing information and data that is going to be
used in the network system. Further, in our paper, we are going to discuss more these things. In this
type of mitigation plan, the attackers are not able to penetrate inside the system and outside the
system to secure fully. After implementing this system in the corporate we will be able to find the
types of attacks and methods used by the attackers so that we can easily install that technology in
our system to protect information and data against different types of cyber threats.
Aims and Objectives
The main aim of this project is to find out that whether the organizations have enough security
measures to protect or prevent the information and data from cyber-attacks on the World Wide
Web. The main objectives for selecting this project are to find out whether the available security
standards and security practices are capable to protect the organizational data and information from
security threats and attacks. Cyber trap products nowadays installed in the private and public sectors
all over the world. Cyber trap products mainly applied to analyze the big data for monitoring the
traffic in the network and provide visibility on both the end of the network of the organizations. It
also provides a plan for the organization to show how they can secure their data and information.
Also, the cyber trap system is going to provide the information about IP and other suspicious
activities of the user as well as a system administrator. The cyber trap technology is going to
support the different type of technology among currently available technologies in the market and
from another different type of security threat situations. Nowadays, different types of organizations
which have daily multiple types of traffic generations at the applications level and from another
different type of security threats use a cyber trap to protect their network. Different types of
security threats are possible so that most of the largest global organization uses cyber trap methods
to manage and secure the information and identities as well as their technology infrastructure.
Cyber trap is the leading solutions that can provide security to loss of data and information over the
system network of the organizations.
Introduction
3

As we see that nowadays network is a form of the business. Many of the organization and enterprise
as well as agencies of government have created user-friendly and tough networks of information are
developed according to the need of the business and users. At current scenario, most of the
technologies come with encryption facilities, wireless, VOIP and secure data storage as well as
different type of web technology through which web services are going to be accessed by the
system of the organization. In today times, most of the customers now do transaction by using the
network of the organization. For attackers and hackers, this network path is making the network
system more vulnerable due to which they have to put only little effort to break the security breach
of the network. Currently, so many people look at the internet as a platform to gather the important
and sensitive data as well as information. However, at the same time, we see that intrusion detection
and prevention systems (IDPS) point out the threats or intruders before they can harm anything on
the network as well as a system of the organization. Intrusion detection system is a type of software
application, which monitors the networks and suspicious activities in the system. These suspicious
activities are going to be reported to the network administrator as well as Security information and
event management (SIEM) system. SIEM system is basically a combination of various output
sources and also they use techniques of alarm filtering to spot the suspicious activities on the
network by activating the false alarm.
In an organization when the system has capabilities of response then they normally come under the
intrusion prevention system. As we see that when any type of business rise and evolve, then they
need to develop their already existing network as well as need to upgrade their network. To
implement this we should analyze the existing network and the needs of a new network which is
important to the company. By doing this we can easily find out what new equipment and other
related things are required to upgrade that the new network of the company fully which supports the
current and future requirements of the organization. In so many cases, according to the needs of
business, there are different types of network connection technologies. To add a new user so many
small and medium companies start adding different type of hardware devices with different
qualities and from different manufacturers. Due to new users, the network strength starts degrading.
If these things are continued then the available network is not able to support the traffic which
network generated due to an increase in the numbers of users.
When the network starts failing then the company decide to redesign their network. Also, the
network service provider and ISP generally provide the installation facilities of new devices and an
advice on how to maintain the upgradation of the network. The design of the network mainly
depends upon the present and future demands of the business to ensure the development of the
company by implementing the right technology. This paper is going to discuss the benefits of next-
generation cyber trap for intrusion prevention server and intrusion detection servers in corporate or
enterprise business. In this, we also were going to explain the IDS product benefits and the
technology that IDS is going to provide for effective protection to the data and information of the
enterprise or corporate business. It also provides knowledge about the different standard of security
and methods to protect the data and information of the organization from the outside attack as well
as cyber-attack.
Literature Review
4

As we see that in today times due to rise in the use of new internet and computer technology in
every sector of life, increases the problems related to the security and privacy of data and
information during their transmission period. Today in modern times so many people are working
on distribution, collection and execution of data as well as information in every business they do.
Currently, there are millions of computers and other different IoT devices are collecting as well as
sharing the data and information every second in the whole world at the same time. Due to this at
the same time, we are facing so many issues in this information age. As we know that data and
information are responsible for the formation of intellectual property, by which people create their
life and secure their privacy and dignity. The court and other legal authority collect personal data
and information related to legal issues. Change from paper to electronic or digital record needs a
change in the security methods and various security measures are required to prevent this type of
threat. The social problem caused due to this issue can be solved with full dignity in this
information age. In this there are so many different types of ethical issues are present.
Here we see that most of the network intrusion system of detection normally placed at that point in
the network from where they can easily monitor the traffic of every device, which are present on the
network. Once the threats and attack are spotted as well as any abnormal behaviour of the system is
detected then an alert message is sent to the network administrator of the organization system. The
system is going to protect the business from existing and upcoming attacks as well as providing
regular control over the system and preventing from cyber threat. The expertise of Next-generation
intrusion prevention system helps in protecting the important data and information as well as
applications from more advanced cyber-attack without harming the enterprise production and its
system performance. Our project mainly aims to explain the different mitigation methodologies or
techniques used by corporate for storing information and data which is going to used in the network
system.
Technologies and Resources
Network intrusions now become the very normal things nowadays. According to the recent
research, it is found that phishing attacks are used in 5.3 billion industries and another business
attack is expected to increase by 9 billion by the end of 2018. Here we can see that there are various
types of security tools like intrusion detection and prevention system to find out the intruders before
they can do serious damage. Following are the top Intrusion Detection and Prevention (IDPS)
providers in the current scenario:
a) McAfee Network Security Plan
This plan provides an intrusion prevention and network threat solution that protects the system and
data of the organization in their data centre. It can provide support up to 32 million connections on a
single device that are mainly going to use intelligence to find out the advanced cyber-attacks on the
entire network of the system.
b) Trend Micro Tipping Point
It is mainly used to spot and block the suspicious activities in the network of the system to prevent
the free movement of the malware and ensure that the availability of network enhances their
performance. It can be installed in the network without IP address and easily remove the unwanted
and suspicious activities. This type of security normally covers the entire footprint of the network
system.
5

c) Darktrace Enterprise Immune System
This system is a machine learning and AI technology for the defense of the cyber threats. Normally
it can easily learn the unique pattern for every device and users available on the network.
d) NSFocus
Here we can see that NSFocus Next Generation Prevention System provides the security threats
protection from block intrusions, various security breaches and other available assets. It uses a
multilayer’s approach to spot the suspicious threats to protect from the various malware, spyware,
protocol attacks and different type of web threats.
e) H3C SecBlade IPS
It is a module for H3C switches and other different types of routers. It is integrated with the system
and provides functions like intrusion detection, prevention, management of bandwidth and filtering
of the virus. It can mainly provide layer 4-7 depth analysis, detection of cyber threats and other
different types of attacks with self-learning as well as response capabilities.
f) Huawei NIP
Huawei network intelligent protection provides the virtual patches, protection to the web
application, protection of client application, antimalware and provides vulnerability-based detection
facilities to protect against the cyber worm infections as well as different types of cyber attacks.
g) Cisco Firepower NGIPS
Here we can see that Cisco next-generation intrusion prevention systems come in software, physical
and virtual devices for small as well as large enterprise and corporation. NGIPS mainly provides
URL based security intelligence and other threat grid integration techniques.
Nowadays most of the system tries to stop an intrusion that is not required and not expected from a
monitoring system. Intrusion detection and prevention systems (IDPS) are mainly aimed for finding
the upcoming threats, logging information and other various types of logging as well as reporting
attempts. Most of the organization uses IDPS for other purposes like spotting the problems with
security policies, documentation of already available threats and violating the security policies.
Therefore, we can say that IDPS become the important method in addition to the security
infrastructure of nearly every organization. IDPS generally collect the information related to the
suspicious activities and inform the system network administrators about important events and
reports of the suspicious activities which occur over the network of the system. They also provide a
different type of response techniques that mainly involves in changing the environment of the
security or helps in changing the content of the different type of attacks.
Intrusion prevention system is known as the intrusion detection and prevention system which
provide network security devices which monitor the network and various type of system activities
for suspicious activities. The main work of the intrusion prevention system is to find out the
suspicious activities, log information, report it and prevent it. Intrusion prevention system is
normally considered an extension of intrusion detection systems because both of them monitors the
network traffic and system activities for suspicious activities. The main difference between
intrusion detection and prevention system is that preventing system placed in line and capable of
actively block and prevent intrusion when they are spotted.
6

7

Methods and Workplan
There are so many methods and work plan by which we can achieve the security of data and
information of any organization. Nowadays in most of the business such as patron want to use the
applications in a different way so that they can easily do their work with more accuracy and
security. As we know that at the current time, most of the organizations use virtualization to reduce
their expenses. It provides file system or hosts the illusion where more physical space is available
than the actual available space. When servers start working fully then it’s very necessary to monitor
them constantly. As we, all see that this Cisco internetworking model is largely used in the industry
to design a scalable, reliable and cost-efficient internetwork. To fulfil the basic goals of an
organization a network must be created on an architecture, which allows both growth and
flexibility. The three-layer model helps in designing, implementing and creating a reliable cost-
effective network. Each layer of this model has its own functionality and features that help in
decreasing the complexity of the network. Using a hierarchical model to develop the IT
infrastructure of an organization can help in minimizing costs.
Design of the network in IT infrastructure is a very larger field and it needs a high level of
knowledge and experience. The Cisco organization model gives all the benefits of a hierarchical
network design on the infrastructure of the campus and provides the design of bigger and more
scalable networks. It provides flexibility in the design of the network and helps in troubleshooting
as well as the implementation of its functionality. Together these sub-modules provide increased
security and flexibility using the access management.
Here we can see that the intrusion prevention system is basically divided into following different
types:
a) NIPS: It is known as a network-based intrusion prevention system which going to monitor the
whole network for a different type of suspicious activities by analyzing the protocol activities.
b) WIPS: It is term as a wireless intrusion prevention system to mainly monitor the wireless
network for malicious activities by monitoring the wireless networking protocols.
c) NBA: Network behaviour analysis used to analyze the traffic of the network to spot the risk that
causes due to the unusual flow of traffic and other different types of attack like DDoS attack, and
other different violation of policy as well as malware attack.
d) HIPS: It is basically known as a host-based intrusion prevention system. It is a type of install
software package which monitors the suspicious activities by analyzing the events which occur in
the network system.
There are also different types of detection methods that determine the organization security
measures due to which they can easily protect or prevent the data and information from the different
type of security threats. These detection methods are enough to provide the security from outside
attacks to the network system of the organization. Most of the intrusion prevention system generally
uses three types of detection methods:
a) Detection based on signature
In this detection methods, we can monitor the packet in the network and compare it with
predetermine and configured patterns of attacks which also term as signatures.
8

b) Detection based on statistics
Intrusion detection system is totally based upon monitor network traffic and compares it against the
fixed baseline.
c) Stateful protocol analysis detection
This method mainly spots the protocol by comparing the available data and information.
As we know that cloud computing is a model for enabling easy, user-friendly and on-demand
network access to shared applications or services which have continuously released with less effort
and interaction with the service provider. Many of the organizations or company can use this
facility to run, host and develop as well as provides services according to the demand of the user at
anywhere, anytime and on any device. According to a report by 2020, 24% of the total addressable
IT market will be a cloud. Integrated security protects the effects of worm, viruses and other attacks
on the design of the network. The module of the data center supports the network management
service for our organisation like logging, monitoring and other management features along with
troubleshooting from the end. The data center of the organization mainly contains the email and
domain name system for the internal use of the company. Before redesigning their network and its
upgradation firstly send a technician onsite to do the survey of the site and documenting the
complete network structure of the company. It is very important to investigate and document the
whole physical structure of the structure to decide where new devices and equipment should be
installed. Nowadays all types of network whether it is small, medium and large have similar types
of fundamentals requirements.
Ethics aspects
As we know that in recent time, data and information is knowledge. Knowledge is power and
invariably power converts into money. Now the more data you have the more money you make. It
is proved that data & information both work as a support system for both consumer and business.
The main problem rises when privacy is invaded, as well as sensitive information and data that is
stored is lost. Due to this individual or company security and privacy ethics become very
vulnerable. Many of the business houses use so many advanced algorithmic analyses to extract data
and information so that they can use it to spot the trends of the market and prevent from the
different ethical issues. The way nowadays the people use the internet is the very high probability
that someone who out knows more about the people than people know about himself. Misuse of
information also comes under major risk. Information that is obtained ethically can be used for
different unethical purposes. As we see that cyberspace is full of security threats like theft of
identity, misuse of social platform, and cyber terrorism. It affects the lives of people personally,
creates threats to national security, and undertake the economy of any country. Cybersecurity
threats related issues can impact in any form like organised cyber attack can cause huge harm to the
structure of information transfer. Data and information which are in the form of documents,
presentations, emails, and databases are the lifeline of the most of the companies and application
which protect and run your organisations requires a lot of space. The threats or risks in cyber
security attack mainly depend upon three factors like who is attacking, weakness where they attack,
and the impact of attacks. The security threats are present external as well as internal. The policy of
usage for computers and other IOT resources play a significant role in cyber security.
9

CONCLUSION
The increasing growth of cybersecurity threats and attacks nowadays demands a new critical
infrastructure that has control and command system. To reduce the impact of the above threats an
organization must have to explain and adopt a strong security policy without any interruption by a
strong commitment of high management and the policy must include corporate database security.
The plan of risk response mainly involves eliminating or reducing the risk threats of the cyberspace.
Promotion of the Cybersecurity Research & Development works should cover every aspect like
developing a system that is trustworthy, instalments and update in whole life cycle provide new
cyber security technology. At the end we can say that cybersecurity has to be upgraded regularly at
different levels, considering the high rates of cyber threats. The government makes cyber security
policy framework very tough by integrating privacy safety which wins the trust and confidence of
the user. There are no security methods which are going to protect your organization from threats,
only they can lower it. When the project is completed in the organization then we need one more
basic step of official approval from all the section of the organization, that whether the system is
correctly working or not to final close of the project. The signoff process mainly responsible for
accountability and control the specific abilities of the network system. The key of project signoff
mainly consists of basic information about the project and specific sign off field.
10

References
Debar, H., Becker, M., and Siboni, D. (1992). A neural network component for an intrusion
detection system. In Proceedings of the 1992 IEEE Computer Society Symposium on Research in
Computer .’security and Privacy, 240-250.
Denning, D. E. (1987). An intrusion detection model. IEEE Transactions on Software Engineering,
SE13:222-232.
Fox, K. L., Henning, leed, J. H., and Simonian. R. (1990). A neural network approach towards
intrusion detection. In Proceedings of the 13th ,V~ltional Computer Security Conference, 125-134
Frank, J. (1994). Artificial intelligence and intrusion detection: Current and future directions. In
Proceedings of the National 17th Computer Sec~lrttt/ Conference.
Garvey, T. D., and Lunt, T. F. (1991). Model-based intrusion detection. In Proceedings of the
14th .V,ttional Computer Security Conference.
Miyata, Y. (1991). A User’s Guide to PlaNet t; rsion 5.6 - A Tool for Constructing, Running, mtd
Looking in to a PDP Network. Computer Science Department, University of Colorado, Boulder,
Boulder, CO.
.Mukherjee, B., Ileberlein, L. T., and Levitt, K. N. (1991). Network intrusion detection. IEEE
Network. 26 -.i 1.
Porr~, P. A..llgun, K., and Kemmerer, R. A. (1998). State transition analysis: A rule-based intrusion
detection approach. IEEE Transactions on Software Engineering, SE-21:181-199.
Teng, II. S., Chen. K., and Lu, S. C. (1990). Adaptive real-! ime anomaly detection using
inductively generated sequential patterns. In Proceedings of th~ 1990 IEEE Srlmposimn on
Research m ComImtcr ,’,’~curzt~l and PrlvactI, 278-284
Wikipedia, The Free Encyclopedia. (2009). Retrieved October 19, 2011, from Wikipedia:
http://en.wikipedia.org/wiki/Geophone
Audette, W. E., Kynor, D. B., Wilbur, J. C., Gagne, J. R., & Peck, L. (2009). Improved Intruder
Detection Using Seismic Sensors and Adaptive Noise Cancellation.
Clarke, B. (2007). Retrieved October 20, 2011, from PSR-1 Seismic Intrusion Detector:
http://www.prc68.com/I/PSR1.shtml
Pakhomov, A., Sicignano, A., Sandy, M., &Goldburt, T. (2003). Seismic Footstep Signal
Characterization. NY
K. Borders. (2008). Protecting confidential information from malicious software. Ph.D.
Dissertation, Dept. University of Michigan, Ann Arbor, MI, USA, 2009.
H. I. Bulbul, I. Batmaz, and M. Ozel. (2008). Wireless network security: comparison of WEP
(Wired Equivalent Privacy) mechanism, WPA (Wi-Fi Protected Access) and RSN (Robust Security
11

Network) security protocols. in Proc. 1st international conference on Forensic applications and
techniques in telecommunications, information, and multimedia, Adelaide, Australia, January,
2008.
XuXiaohui. (2013). “Study on Security Problems and Key Technologies of the Internet of
Things”Computational and Information Sciences (ICCIS), 2013 Fifth International Conference on,
Issue Date: 21-23 June 2013
12