Analysis and evaluation of network intrusion detection methods to uncover data theft

摘要: Nowadays, the majority of corporations mainly use signature-based intrusion detection. This trend is partly due to fact that signature detection a well-known technology, as opposed anomaly which one hot topics in network security research. A second reason for this may be detectors are known generate many alerts, being false alarms. Corporations need concrete comparisons between different tools order choose best suited their needs. thesis aims at comparing an detector with establish detect data theft threat. The aim influence training period length Intrusion Detection System (IDS) on its rate. presents Network-based (NIDS) evaluation testbed setup. It shows setup two IDSes, Snort and Statistical Packet Anomaly Engine (SPADE). also includes scenario (reconnaissance, brute force attack server theft). results from experiments carried out proved inconclusive, SPADE requires configuration adapted monitored. Despite experimental could act documentation setting up NIDS testbed. considered SPADE. statement made observation there no centralised about SPADE, not single research paper documents