Project: Cybertrap for Intrusion Detection in Enterprise Business

This project dissertation focuses on developing a Next-Generation Cybertrap for corporate intrusion detection and prevention servers within enterprise businesses. The project begins with an introduction outlining the aim, objectives, background, motivation, problem statement, proposed solution, and structure of the thesis. A comprehensive literature review provides context and supports the subsequent technical discussions. The core of the project delves into the technology, approach, design, and implementation of the Cybertrap system. Key modules such as the Malware Detector, Intrusion Detector, Honeypot Manager, Auditor, and Backup Manager are described in detail, explaining their functionalities and interactions. The project also discusses intrusion prevention servers, firewalls, and the challenges associated with intrusion detection, including effective deployment, alert management, investigation, and threat response. Overall, the project aims to enhance corporate network security by proactively detecting and mitigating cyber threats through a sophisticated Cybertrap system. The project emphasizes the importance of protecting sensitive data and applications from evolving cyber threats.

Project Dissertation
Title: Next-Generation Cybertrap for Corporate Intrusion Detection Servers and
Intrusion Prevention Servers in Enterprise Business

TABLE OF CONTENTS
INTRODUCTION...........................................................................................................................4
Aim and Objectives....................................................................................................................11
Background and motivation.......................................................................................................12
Problem......................................................................................................................................12
Proposed solution.......................................................................................................................12
Structure of thesis.......................................................................................................................12
Summary....................................................................................................................................13
LITERATURE REVIEW..............................................................................................................14
TECHNOLOGY............................................................................................................................21
APPROACH..................................................................................................................................34
DESIGN.........................................................................................................................................42
IMPLEMENTATION....................................................................................................................47
CONCLUSION..............................................................................................................................55
REFERENCES..............................................................................................................................56

ABSTRACT
Next Generation Intrusion Prevention Systems is also term as Intrusion Detection & Prevention
Systems (IDPS). Here we can see that Next Generation Cyber trap for corporate intrusion
detections server and intrusion prevention servers in Enterprise business that consists of different
network security applications which monitor the network and suspicious activities in the system.
This system will protect the corporate from the default attacks to the new attack and also controls
the system and prevent the system by the cyber threat. The expertise of Next-generation intrusion
prevention system helps to protect the sensitive data and the information also the application
from the cyber threat and manage the performance of the system. Our project is mainly focused
on explaining the different mitigation methodologies or techniques used by corporate for storing
information and data that is going to be used in the network system. Further, in our paper, we are
going to discuss more these things. In this type of mitigation plan, the attackers are not able to
penetrate inside the system and outside the system to secure fully. After implementing this
system in the corporate we will be able to find the types of attacks and methods used by the
attackers so that we can easily install that technology in our system to protect information and
data against different types of cyber threats.

CHAPTER 1
INTRODUCTION
1. INTRODUCTION
Cyber Trap becomes the trendsetting word in the growing generations’ minds who work upon a
lot on the internet. This word will be more familiar for the corporate companies as they come
through such problems day-to-day basis. They make their process on the internet which will
make their work so easier and instant. Believing in this, these crew people collect data from the
internet but they were not aware of the problems which will affect them later. Due to this
access of internet, the hidden side of the internet gets wild and gains a lot of profit, but locating
and targeting the small corporate companies because they don’t maintain high security on the
internet. But they do believe that they have strong security connections that no one could enter
the area and access the data. Their intention is completely wrong because Cyber trap is a huge
background trap that takes out the data from their site with ease of effort. They are otherwise
called as attackers of corporates who enjoy a lot in trapping and getting out the data at the most
level (Anita, K. et al., 2010).
According to a recent survey, it is obvious that 96% of the business people are fooled by the
Cyber Trap method. To know about the happenings, the company brought out an idea to detect
the attack made by the internet user. Then there was an emergence of a processor called
honeypots to detect the malware capture, which is placed in a corner of a network to capture the
attackers. The proposed system is capable of detecting the network attacks on significant
resources and to capture the malware being spread in the network. This system consists of
various modules to monitor the system after knowing and understanding the basics from the
human interaction. During the initial process of the detectors, they learn about the signature and

the behaviour of the malware. Later they were fed with the modern executables and binaries
system which those capable to find out the malware which harms the computing network. This
package checks for the malicious match to find out the harm material (Anita, K. et al., 2010).
Then cyber trap came into charge, the Intrusion Detection module which acts more effective
which watches out for the intrusion chances. When an attack is made, it comes into act making
an attentive alarm which intends in creating a honeypot to which will be the replica of the
victim resource. All the services which were running on the victim machine will be faked into
the honeypot, in case of this, the attacker will redirect. But the IDS are very conscious clear that
the redirected work should not be found out by the attacker. This additional feature of this
makes a good hype in this intrusion module detector. This even too provides a system called
sandbox, which will not harm the operation of the original resources and maintain the records
in a safe manner. There comes along an automated honeypot management system which
manages such critical circumstances. Every particular process will have a design feature which
goes from initial to final stages. This design has made with five different modules namely
Malware detector, an Intrusion detector, Honeypot Manager, Auditor and Backup manager
(Asmaa Shaker Ashoor, et al., 2012).
To know about the attackers, the inventors had different methods of a plan to make the
attackers attract towards their honeypots. To make this happen they made their trap by making
the server most requested one and high ranking one which will lure more attackers. By that
time, the initial stage which is the Malware detector checks for the incoming threats whereas
the other modules will not get into charge unless they are needed. The honeypot manager
created the honeypots for the attackers to be detected to the server, then the Auditor checks the
system for any malicious activity and in the generated logs after particular events next comes

the Backup manager who will in charge to back up the resources and honeypots whenever
necessary (Asmaa Shaker Ashoor, et al, 2012).
Malware Detector
The malware detector works with collaboration and runs independently on the internet to detect
and capture any malware in the network. This module consists of various functions, search for
malware in different ways, and later submits the result to the server for further research. This
module has 3 types naming fetcher, watcher and hunter. A fetcher is a service which does
cross-matching to catch any malicious files. Watcher watches the network for any harm file to
capture. Hunter is a pre-processor which extracts Windows binaries which come into the
network and checks them for the unwanted harm files (DerisStiawan et al, 2011).
Intrusion detector
Intrusion detector is similar when compared with the Hunter detector which is a pre-processor
which controls the calling of other modules. Whenever there is an intrusion, the intrusion
detector detects and shoots out an alert and calls other modules if necessary alone. The
intrusion detector module has a function for log parsing, which keeps its eyes on the log for
intrusion attempts. Even in this case, if a harm is detected an alarm is provided to the
administrator. The module looks for the harm, if any harm is detected; it connects with the
honeypot module to create a honeypot and deal further with the attacker (DerisStiawan et al,
2011).

Honeypot Manager
This is one of the important modules is the honeypot manager, which creates a honeypot to
locate the threats. The main function of this is to create a honeypot to take out the threats by
fetching information from the intrusion detector. This module provides a sandbox feature so
that the attacker can play inside the honeypot without interrupting the original resources
(DerisStiawan et al, 2011).
Auditor
The auditor module functions to collect all the data connecting to the network to check for the
intrusion or network changes. It checks for all changes which should be sent to the Honeypot
manager so that it can able to create an absolute replica of the damaged data (DerisStiawan et
al, 2011).
Backup Manager
The function of the Backup manager is so relevant to the name of the heading that it should
keep a backup of resources and the honeypots. This module takes regular backups and always
will be ready to provide the replica of resources and honeypots, to provide restoration in case of
any sudden events. It would also be capable of creating a Honeypot which was previously
attacked by the attacker. When instead of getting a clean honeypot, if an attacker gets a
resource with plenty amount, he might tend to leave some traces as the attacker will be keen on
taking out the data and the attacker will not be recognising that they are playing with honeypot
which would easily find out the attacker. The Honeypot manager too contains the backup of the
resource (DerisStiawan et al, 2011).

1.2 INTRUSION PREVENTION SERVER
Intrusion prevention is as similar to intrusion detector in which it is detected and taken out, but
the advanced level of it is the intrusion prevention which prevents the attackers enter into the
network which is much required every corporate company who maintain their most valuable
and important data in the network. An exploit may carry out an instant after the attackers gain
access whereas the intrusion prevention detector has the ability to take quick action on it based
on some kind of rules framed by the administrator. An effective intrusion detector should
perform very complex monitoring and analysis such as watching to the activity and responding
to the administrator patterns and individual patterns. To be factual, an Intrusion Prevention
System should use any product or method that is used to keep away the attackers from
compromising the networking using some concepts like firewalls and anti-virus software.
1.3 FIREWALL
Firewall is an internet security which controls the incoming signals and outgoing signals in the
networking server. Network firewalls filter the traffic between the signals and run on computer
hardware. Mostly, a firewall is always installed away from the remaining network so that no
other illegal signals enter into the private sector of the company.
The firewall has three layers which protect the data to be attacked.
1. Packet filters firewall
2. Stateful filters firewall
3. Application layer firewall

1.4 CHALLENGES OF INTRUSIVE DETECTION SERVER
Network and intrusion detection systems play a wide role in securing the data by preventing the
data entry into the servers of corporates. To know the capacity of the technology, the
organizations must face a number of challenges (Jaiganesh, V. et al., 2013).
The challenges are,
Ensuring an effective deployment
While receiving such threats from the attackers, the organisations must make sure that the
security is in a high level that is an effective deployment. In the world, many companies were
not aware of their entire view of the network so deploying Intrusive Detection server can be so
difficult.So the organization has to make sure that they ensure a good deployment (Jaiganesh,
V. et al., 2013).
1.4.1 Managing the high volume of alerts
To manage high-level threats, the server is fixed with a great alert signal which indicates the
illegal entry in the network or when the receiving signal does not match the pattern. So that the
alert volume should be hyperactive so that the company can compete for the internet world with
full confidence which too helps them maintain their data in a secure manner (John McHugh, et
al).
1.4.2 Understanding and investigating the alerts
Intrusive Detection Server consists of a very base level security; it looks so normal type of
security when it is placed alone. When updated with an alert, it looks good and effective for
detecting the threats. When the IDS is investigated for its alerts it takes very less time and

fewer resources when compared to the other system which tends to determine the seriousness
of the alarm. Special skills are required for interrupting the system output where the
organization may lack the security in performing such functions (John McHugh, et al).
1.4.3 Knowing how to respond to threats
IDS is very much effective in identifying the appropriate problem which is a great feedback for
the corporate companies but they couldn’t be too confident that they have high security because
Intrusion detection server just locates the problem which is just half the problem solved. To
solve the problem is important whereas responding correctly to the problem is more important
which behaves as the half the process of solving the problem. The lack happens here in this
IDS. Effective incident requires skills in this and have to know about the robust procedures to
solve the problem. To emphasize the importance of having unsuitable incident response plan,
the incoming General Data Protection Regulation (GDPR) requires organizations that continue
any type of data to have perfect controls in a perfect place to report the security breaches to a
related authority within two days or it will lead to a huge amount of dues (John McHugh, et al).
1.5 ADVANTAGES OF INTRUSION DETECTION SERVER
1.5.1 Constant Network Monitoring
Constant Network monitoring continuously works all 24*7 for the corporates which make them
fear free from the attackers. This feature allows the server to be safe even when the user is in
sleep or awake. It maintains security and detects the attacker and produces an alert signal to the
management (PeymanKabiri and Ali A.Ghorbani, 2005).
1.5.2 Versatility of the system

Intrusive detection server is customizable to accommodate special client needs. The
appointment will be based on the versatile performance of an individual so that he can be
efficient enough to analyse the attacks and produce solutions to it. The system can monitor the
threats from both the inside and outside the network with the help of the system behaviour the
threats can be identified (PeymanKabiri and Ali A.Ghorbani, 2005).
1.6 DISADVANTAGE OF INTRUSIVE DETECTION SERVER
1.6.1 Telling a threat from a friend
The main disadvantage is that they do not have the ability to tell the information from friend to
foe. Users inside may have a harmless activity which will lead to lockdown to the network. It
will be as same as locked until an undetermined amount of time. The professional has to be
available all time to identify and reset the threat. For a business class people, this can cause a
drastic loss of revenue an client confidence, as any of companies partner may take business
elsewhere to a company with a reliable network (PeymanKabiri and Ali A.Ghorbani, 2005).
1.7 AIM AND OBJECTIVES
 The main aim of this project is to find out that whether the organizations have
enough security measures to protect or prevent the information and data from
cyber-attacks on the World Wide Web.
Objectives
The main objectives for selecting this project are to find out whether the available security
standards and security practices are capable to protect the organizational data and information
from security threats and attacks.

1.8 BACKGROUND AND MOTIVATION
Cyber trap products nowadays installed in the private and public sectors all over the world.
Cyber trap products mainly applied to analyze the big data for monitoring the traffic in the
network and provide visibility on both the end of the network of the organizations. It also
provides a plan for the organization to show how they can secure their data and information.
Also, the cyber trap system is going to provide the information about IP and other suspicious
activities of the user as well as a system administrator. The cyber trap technology is going to
support the different type of technology among currently available technologies in the market
and from another different type of security threat situations.
1.9 PROBLEM
Nowadays, different types of organizations that have daily multiple types of traffic generations
at the applications level and from another different type of security threats use a cyber trap to
protect their network. Different types of security threats are possible so that most of the largest
global organization uses cyber trap methods to manage and secure the information and
identities as well as their technology infrastructure.
1.10 PROPOSED SOLUTION
Cyber trap is the leading solutions that can provide security to loss of data and information over
the system network of the organizations.
1.11 STRUCTURE OF THESIS
The thesis starts with the chapter 1.Introduction of next generation cybertrap for the corporate.
In chapter 2.Literature review about the intrusion prevention and detection are surveyed. In