Early Intrusion Detection System (IDS) using Snort and Telegram approach

Abstract

Computer network security is an important factor that must be considered. Guaranteed security can avoid losses caused by attacks on the network security system. The most common prevention against network attacks is to place an administrator, but problems will arise when the administrator is not supervising the network, so to overcome these problems a system called IDS (Intrusion Detection System) can detect suspicious activity on the network through automating the work functions of an administrator. Snort is one of the software that functions to find out the intrusion. Data packets that pass through network traffic will be analyzed. Data packets detected as intrusion will trigger alerts which are then stored in log files. Thus, administrators can find out intrusions that occur on computer networks, and the existence of instant messaging applications can help administrators to get realtime notifications, one of which is using the Telegram application. The results of this study are, Snort able to detect intrusion of attacks on computer networks and the system can send alerts from snort to administrators via telegram bot in real-time.

Implementation of signature-based intrusion detection system using SNORT to prevent threats in network servers

“…Snort is logically divided into some parts. SNORT is an open source IDS for monitoring and preventing attacks on computer security and produces the output to be a required format of the detection system [19]. When working as an IDS, SNORT can detect attacks or data packets that enter computer networks and warn network administrators to take precautions.…”

Monitoring Notifikasi Status Services Pada Os Linux Menggunakan Bot Telegram

“…Meskipun terlihat sederhana aplikasi instant messaging Telegram memiliki fitur yang lebih unggul dibandingkan aplikasi instant messaging lainnya. Telegram diklaim sebagai aplikasi yang aman dimana menyediakan pilihan pesan end-to-end yang akan di enskripsi [4].…”

Teler Real-time HTTP Intrusion Detection at Website with Nginx Web Server

“…Nginx is a lightweight web server as well as a reverse proxy server. It is well known for its less memory usage and reliable concurrency [10]. Because of the reliability, of course, the Nginx web server will be very suitable for Teler, which can be run with high concurrency values.…”

“…The preprocessor can be used to log scanning activity to a specific location other than a standard log file. Hackers can use some port scanning, for example, Nmap as a port scanning tool [10].…”