University-Level of eLearning in ASEAN Early Intrusion Detection System (IDS) using Snort and Telegram approach SISFORMA: Journal of Information Systems (e-Journal) Vol.7 | No.1 |Th.2020. 21 ISSN 2442-7888 (online) DOI 10.24167/Sisforma Early Intrusion Detection System (IDS) using Snort and Telegram approach Aan Erlansari 1, Funny Farady Coastera 2, Afief Husamudin 3 1,2,3Infomatika, Faculty of Engineering, University of Bengkulu. Jl. WR. Supratman Kandang Limun Bengkulu 38371A INDONESIA (Tel: 0736-341022; fax: 0736-341022) 1 Aan_erlanshari@unib.ac.id 2ffaradyc@unib.ac.id 3Afiefh17@gmail.com Abstract— Computer network security is an important factor that must be considered. Guaranteed security can avoid losses caused by attacks on the network security system. The most common prevention against network attacks is to place an administrator, but problems will arise when the administrator is not supervising the network, so to overcome these problems a system called IDS (Intrusion Detection System) can detect suspicious activity on the network through automating the work functions of an administrator. Snort is one of the software that functions to find out the intrusion. Data packets that pass through network traffic will be analyzed. Data packets detected as intrusion will trigger alerts which are then stored in log files. Thus, administrators can find out intrusions that occur on computer networks, and the existence of instant messaging applications can help administrators to get realtime notifications, one of which is using the Telegram application. The results of this study are, Snort able to detect intrusion of attacks on computer networks and the system can send alerts from snort to administrators via telegram bot in real-time. Keywords— IDS (Intrusion Detection System), Monitoring, Network Security, Real-time, Snort, Telegram I. INTRODUCTION Security could be a huge issue for all networks in today’s enterprise domain. Hackers and intruders have created several fortunate efforts to bring down company organization and network services. Several strategies are developed to secure the network infrastructure and communication over the web, among them the utilization of firewalls, encryption, and virtual non-public networks. Intrusion detection could be a comparatively new addition to such techniques. Intrusion Detection System began disclosure over the foremost recent number of years. Utilizing interruption location techniques, you will be able to gather and use knowledge from sorts of disruptions and see whether or not someone is trying to assault your system or specific hosts. The data gathered on these lines are often used to solidify your system security, even as for legitimate functions. Various weak appraisal instruments are too accessible inside the advertising that may be used to survey distinctive types of security gaps show in your organization. The suggested work is to scale back the malicious activities by characteristic the intruders early in network done through the observance of the node behavior/features with Snort and wire. During this paper, we tend to designed efficient intrusion detection. The system contains 3 phases like feature choice, outlier detection, and classification. The primary contribution of this paper is that the introduction of a brand new feature choice formula referred to as intelligent complete feature choice that helpful|is beneficial|is helpful} for recommending the useful options. The second phase of this paper is the introduction of a brand new detection methodology referred to as an entropy-based weighted outlier detection methodology for removing the useless records. The third contribution of this paper is that the use of the prevailing classification formula referred to Early Intrusion Detection System (IDS) using Snort and Telegram approach SISFORMA: Journal of Information Systems (e-Journal) Vol.7 | No.1 |Th.2020. 22 ISSN 2442-7888 (online) DOI 10.24167/Sisforma as showing an intelligence layered approach for effective classification. The most advantage of this projected work is to pick out the helpful options that are helpful to boost the classification (intrusion detection) accuracy. The rest of this paper is managed as follows: Section two provides the literature survey and system development model. Section three demonstrates the results and discussion. Section four provides a conclusion and also the future works II. LITERATUR REVIEW The early analysis was explicit that Intrusion Detection System (IDS) datasets that were created in university Lincoln Laboratories are wont to assess the performance of Snort [1][2]. The analysis of snort is completed supported the detection rate. It's been found and concludes that snort detection rate is required to boost and additionally the false alert ought to be reduced to boost the general performance of snort. Here, Snort is evaluated on week three, week 4, and week five knowledge. The week three data is attack free and able to train Snort. Week four and week five data include attacks and are utilized in the testing part. Throughout the testing part, Snort generates many alarms: Table 1 event logged by the snort Day 1 2 3 4 5 No of even 18557 6392 2092 3490 7780 Nevertheless, Rishab stated [3] that snort can show all matches packet outlined by the administrator. The data stored in MySQL database that we have created a UI to show all the required data regarding the alert generated. The knowledge includes supply IP, Destination IP, Alert generated, Date, and Time of once the packet was received. Natawat [4] in his research built a snort system using IDS as a result of Intrusion detection systems are efficient network security tools for detective work and observance network traffic knowledge. They generate associate alert once abnormal behavior patterns are matched to existing rules. However, as a result of the IDS could have high false positive and false negative values, we have proposed another system, incorporating data processing of the association rules inside the Snort IDS. The system was completely tested and compared to the first Snort IDS Rules also as icmp.rules and ICMP-info.rules inside the Snort IDS, the system proven to be more useful and more precise. A. Intrusion Detection System The intrusion detection system (IDS) is often defined as a tool or associate application that detects malicious activities or policy violations inside the network. IDS has been widely utilized in recent years united of the most network security parts. The target of this study is to search out the best-fit approach that might considerably scale back the number of options. Besides, the approach would result in high classification accuracy with less process time [5]. In order to avoid computer users from malicious effects, IDS (intrusion detection system) is is meant to seem out network activities and manufacture alerts to several persons like administrative and others [6]. IDS is used for two purposes: one methodology is used to identify known attacks, and the other method is used for unknown attacks. The implementation of the second technique isn't simple, and therefore the system ought to come with the correct learning and testing method. B. Snort Snort is that the form of the Intrusion Detection System that's used for scanning databases flowing on the network [7], [8]. Snort logically divided into multiple components. Snort logically divided into multiple parts. These parts work along to find specific attacks and generate output into a needed format from the detection system [9]. A snort-based IDS consists of following major components as shown in the table: Table 2 Components of Snort Name Description Packet Decoder Prepares packet for processing Preprocessors on Input Plugins Used to normalized protocol header, detect anomalies, packet- reassembly, and TCP stream re- assembly Early Intrusion Detection System (IDS) using Snort and Telegram approach SISFORMA: Journal of Information Systems (e-Journal) Vol.7 | No.1 |Th.2020. 23 ISSN 2442-7888 (online) DOI 10.24167/Sisforma Detection Engine Applies rules to packets Logging and Alerting System Generates alert and log messages Output Modules Process alerts and logs and generate a final output Figure 1 shows the Snort IDS rules generator procedure. The association rules of the defined parameter’s entries are used to generate the Snort IDS rules by the MinSIC module for detecting network probe attacks. Figure 1 Snort IDS generator rules The Snort IDS rules exhibitions were assessed by utilizing the precision comparisons method. Appropriate parameters, as seen in Table 2, layout the Grunt IDS rules as appeared in Figure 1. C. Scanning Port scanning is a process of finding out which ports are open on a particular host or all hosts on a network[9]. The first step in any intruder activity is usually to find out what services are running on a network. Once an intruder has found this information, attacks for known vulnerabilities for these services are tried. The portscan preprocessor is designed to detect port scanning activities. The preprocessor can be used to log the port scanning activities to a particular location in addition to standard logging. Hackers can use multiple port scanning methods. Refer to man pages or documentation of the Nmap utility [10] to learn more about port scanning methods. The Nmap utility is a widely used tool for port scanning. The following is the general format of the preprocessor used in the snort.conf file. preprocessor portscan: