Intrusion detection in Honeynets by compression and hashing

摘要: This paper proposes the design of a behaviour-based Intrusion Detection System (IDS), adopting Fuzzy hashing and Normalized Compression Distance (NCD) to determine similarity in behavioural profiles worms malware. The system runs parallel with an existing knowledge or misuse-based like Snort, but augments intrusion detection capabilities by revealing malicious behaviour activities within Honeynet. integrates into Honeynet, where network-based events will be trapped gateway device, while system-based on Honeypot(s). Results prototype network components are also discussed.