I am currently occupied on the research of my final year project i.e. Network Intrusion Detection System. I am planning to implement machine learning in the project. After the system is trained with standard data set all I want is to test the system with the packets obtained from network. What might be the efficient way to do that and what problems might I face?
Dear Deepak,
You need to consider 5 points during implementation of NIDS
1. Location of NIDS
2. Scalability
3. Constant Update and Training (To detect new attacks)
4.Efficiency in detecting new attacks
5. Performance in detecting attacks.
If you have these points clear, you won't face much challenge.
You can refer my Publication for your reference.
All the best for your project
Regards
Praveen
Testing is hard. It is very hard. Delay will be your killer. You need to sniff packets, extract features use your model obtain results inform administrator before an attack takes place. Detection does not impact the delay of packets since it is not responsible of preventing.
Another issue is zero day attacks, how to detect them ? If for example you used KD99 dataset in your work, this dataset is before 15 years. So how can you detect new attacks?
One more thing, sniffing data in big network will be slow. If you try to collect your data in a computer you will find that some packets are not there. It will be slow to detect all packets in the network.
Finally, your PC must become gateway of your network to sniff everything, you need linux since windows has issues in sniffing "I work with python so I have issues with windows". This will be easy for you. Good LUCK
- Badges
- Science topic