Detecting Cyber Threats With a Graph-Based NIDPS

Abstract

This chapter explores the topic of a novel network-based intrusion detection system (NIDPS) that utilises the concept of graph theory to detect and prevent incoming threats. With technology progressing at a rapid rate, the number of cyber threats will also increase accordingly. Thus, the demand for better network security through NIDPS is needed to protect data contained in networks. The primary objective of this chapter is to explore the concept of a novel graph based NIDPS through four different aspects: data collection, analysis engine, preventive action, and reporting. Besides analysing existing NIDS technologies in the market, various research papers and journals were explored. The authors' solution covers the basic structure of an intrusion detection system, from collecting and processing data to generating alerts and reports. Data collection explores various methods like packet-based, flow-based, and log-based collections in terms of scale and viability.