Member Avatar for naveed.pasha

Hi all!

I've started a little late doing my final year university project, but I know what I want to do so it's probably better than a few of the other students out there!

I do enjoy reading and studying about the wide variety of topics that are encompassed by network and computer security. I want to develop an Intrusion Detection System, possibly making it platform independent into a network intrusion detection system (NIDS). I've been doing quite a bit of research and there are a wide selection of functions I could include and could not include. Anyhow, I've come here to ask assistance in actually planning the programming or how to go about it and suggestions on which functions I should or shouldn't include. By the way, the primary aim for this final year project is to develop a IDS of some sort and display it functioning, possibly it to have some configurable characteristics, maybe using some sort of penetration testing tool or developing one myself along with the IDS to test it working.

In doing all of this I also hope to gain a greater insight into network and computer security...
All suggestions and ideas are welcome anything to point me in the right direction is much appreciated!

Kind Thanks

  • 4 Contributors
  • 3 Replies
  • 611 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Salem

Dani AI

Generated

A practical plan for a final-year IDS project (as requested by ) starts with a narrow, measurable scope and a modular architecture. Decide early whether the goal is a network IDS (NIDS) or a host IDS (HIDS), and whether detection will be signature-based (rule engine) or anomaly-based (statistical/ML). For a single-semester deliverable, a NIDS prototype that includes a packet-capture layer, a simple rule engine and a test harness is achievable; kernel drivers or inline blocking can be treated as later extensions. As points out, kernel-level hooks increase platform dependence; a user-space pcap approach is much easier to implement and demonstrate. 's pointer to open-source IDS projects helps with feature scoping, and 's suggestion about security forums applies if deeper domain feedback is needed.

Suggested architecture: capture -> reassembly/normalization -> detection -> logging/alerting -> management/UI. A pcap-compatible capture layer (libpcap/Npcap) keeps the capture code portable across Unix and Windows. Early filtering with BPF reduces processing load. A minimal C/C++ capture loop looks like:

#include <pcap.h>

char errbuf[PCAP_ERRBUF_SIZE];
pcap_t *handle = pcap_open_live("eth0", BUFSIZ, 1, 1000, errbuf);
struct pcap_pkthdr header;
const u_char *packet;
while ((packet = pcap_next(handle, &header)) != NULL) {
    /* parse packet headers, normalize, feed detection engine */
}
pcap_close(handle);

Testing strategy: an isolated VM lab (attacker, victim, monitoring host) can be used to generate labeled PCAPs via controlled scans and simple exploits; those PCAPs serve for rule tuning and evaluation. Measured metrics should include detection rate, false positive rate, precision/recall, packets-per-second throughput and processing latency. Public datasets exist but frequently require cleaning; a small, repeatable local testbed provides stronger, demonstrable evidence for an academic project.

Recommended milestones: weeks 1-2 requirements and prototype; 3-6 capture/parsing and rule engine; 7-10 testing, tuning and logging; final weeks for documentation and demo. Common pitfalls include attempting ML without labeled data, starting kernel drivers too early, and neglecting evaluation. The final system should be modular and log-rich, and testing must be legally confined to isolated lab networks.

Recommended Answers

All 3 Replies

Member Avatar for n.aggel

although i cannot help you with what you want, maybe you would get more help if you made this post in a more security oriented forum {i can't suggest one, but there must be alot of them}...

Member Avatar for dubeyprateek

I can’t say if you can design anything platform independent here. You have to call core APIs that too of kernel level. May be you want something like filter driver.

Intrusion are 99% not platform independent in fact they are very very platform dependent, solution has to be platform dependent.

Unfortunate I can’t help you with Linux(bcoz I don’t know much about internals of Linux), however if you target Windows there are tons of resources on MSDN website.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.