University-Level of eLearning in ASEAN
Early Intrusion Detection System (IDS) using Snort and Telegram approach
SISFORMA: Journal of Information Systems (e-Journal) Vol.7 | No.1 |Th.2020. 21
ISSN 2442-7888 (online) DOI 10.24167/Sisforma
Early Intrusion Detection System (IDS) using Snort and
Telegram approach
Aan Erlansari 1, Funny Farady Coastera 2, Afief Husamudin 3
1,2,3Infomatika, Faculty of Engineering, University of Bengkulu.
Jl. WR. Supratman Kandang Limun Bengkulu 38371A INDONESIA
(Tel: 0736-341022; fax: 0736-341022)
1 Aan_erlanshari@unib.ac.id
2ffaradyc@unib.ac.id
3Afiefh17@gmail.com
Abstract— Computer network security is an
important factor that must be considered.
Guaranteed security can avoid losses caused
by attacks on the network security system.
The most common prevention against
network attacks is to place an administrator,
but problems will arise when the
administrator is not supervising the network,
so to overcome these problems a system
called IDS (Intrusion Detection System) can
detect suspicious activity on the network
through automating the work functions of an
administrator. Snort is one of the software that
functions to find out the intrusion. Data
packets that pass through network traffic will
be analyzed. Data packets detected as
intrusion will trigger alerts which are then
stored in log files. Thus, administrators can
find out intrusions that occur on computer
networks, and the existence of instant
messaging applications can help
administrators to get realtime notifications,
one of which is using the Telegram
application. The results of this study are,
Snort able to detect intrusion of attacks on
computer networks and the system can send
alerts from snort to administrators via
telegram bot in real-time.
Keywords— IDS (Intrusion Detection System),
Monitoring, Network Security, Real-time, Snort,
Telegram
I. INTRODUCTION
Security could be a huge issue for all
networks in today’s enterprise domain.
Hackers and intruders have created several
fortunate efforts to bring down company
organization and network services. Several
strategies are developed to secure the network
infrastructure and communication over the
web, among them the utilization of firewalls,
encryption, and virtual non-public networks.
Intrusion detection could be a comparatively
new addition to such techniques.
Intrusion Detection System began
disclosure over the foremost recent number of
years. Utilizing interruption location
techniques, you will be able to gather and use
knowledge from sorts of disruptions and see
whether or not someone is trying to assault
your system or specific hosts. The data
gathered on these lines are often used to
solidify your system security, even as for
legitimate functions. Various weak appraisal
instruments are too accessible inside the
advertising that may be used to survey
distinctive types of security gaps show in your
organization.
The suggested work is to scale back the
malicious activities by characteristic the
intruders early in network done through the
observance of the node behavior/features with
Snort and wire. During this paper, we tend to
designed efficient intrusion detection. The
system contains 3 phases like feature choice,
outlier detection, and classification. The
primary contribution of this paper is that the
introduction of a brand new feature choice
formula referred to as intelligent complete
feature choice that helpful|is beneficial|is
helpful} for recommending the useful
options. The second phase of this paper is the
introduction of a brand new detection
methodology referred to as an entropy-based
weighted outlier detection methodology for
removing the useless records. The third
contribution of this paper is that the use of the
prevailing classification formula referred to
Early Intrusion Detection System (IDS) using Snort and Telegram approach
SISFORMA: Journal of Information Systems (e-Journal) Vol.7 | No.1 |Th.2020. 22
ISSN 2442-7888 (online) DOI 10.24167/Sisforma
as showing an intelligence layered approach
for effective classification. The most
advantage of this projected work is to pick out
the helpful options that are helpful to boost
the classification (intrusion detection)
accuracy.
The rest of this paper is managed as
follows: Section two provides the literature
survey and system development model.
Section three demonstrates the results and
discussion. Section four provides a
conclusion and also the future works
II. LITERATUR REVIEW
The early analysis was explicit that
Intrusion Detection System (IDS) datasets
that were created in university Lincoln
Laboratories are wont to assess the
performance of Snort [1][2]. The analysis of
snort is completed supported the detection
rate. It's been found and concludes that snort
detection rate is required to boost and
additionally the false alert ought to be reduced
to boost the general performance of snort.
Here, Snort is evaluated on week three, week
4, and week five knowledge. The week three
data is attack free and able to train Snort.
Week four and week five data include attacks
and are utilized in the testing part. Throughout
the testing part, Snort generates many alarms:
Table 1 event logged by the snort
Day 1 2 3 4 5
No of
even
18557 6392 2092 3490 7780
Nevertheless, Rishab stated [3] that snort
can show all matches packet outlined by the
administrator. The data stored in MySQL
database that we have created a UI to show all
the required data regarding the alert
generated. The knowledge includes supply IP,
Destination IP, Alert generated, Date, and
Time of once the packet was received.
Natawat [4] in his research built a snort
system using IDS as a result of Intrusion
detection systems are efficient network
security tools for detective work and
observance network traffic knowledge. They
generate associate alert once abnormal
behavior patterns are matched to existing
rules. However, as a result of the IDS could
have high false positive and false negative
values, we have proposed another system,
incorporating data processing of the
association rules inside the Snort IDS. The
system was completely tested and compared
to the first Snort IDS Rules also as icmp.rules
and ICMP-info.rules inside the Snort IDS, the
system proven to be more useful and more
precise.
A. Intrusion Detection System
The intrusion detection system (IDS) is
often defined as a tool or associate application
that detects malicious activities or policy
violations inside the network. IDS has been
widely utilized in recent years united of the
most network security parts. The target of this
study is to search out the best-fit approach that
might considerably scale back the number of
options. Besides, the approach would result in
high classification accuracy with less process
time [5]. In order to avoid computer users
from malicious effects, IDS (intrusion
detection system) is is meant to seem out
network activities and manufacture alerts to
several persons like administrative and others
[6]. IDS is used for two purposes: one
methodology is used to identify known
attacks, and the other method is used for
unknown attacks. The implementation of the
second technique isn't simple, and therefore
the system ought to come with the correct
learning and testing method.
B. Snort
Snort is that the form of the Intrusion
Detection System that's used for scanning
databases flowing on the network [7], [8].
Snort logically divided into multiple
components. Snort logically divided into
multiple parts. These parts work along to find
specific attacks and generate output into a
needed format from the detection system [9].
A snort-based IDS consists of following
major components as shown in the table:
Table 2 Components of Snort
Name Description
Packet
Decoder
Prepares packet for processing
Preprocessors
on Input
Plugins
Used to normalized protocol
header, detect anomalies, packet-
reassembly, and TCP stream re-
assembly
Early Intrusion Detection System (IDS) using Snort and Telegram approach
SISFORMA: Journal of Information Systems (e-Journal) Vol.7 | No.1 |Th.2020. 23
ISSN 2442-7888 (online) DOI 10.24167/Sisforma
Detection
Engine
Applies rules to packets
Logging and
Alerting
System
Generates alert and log messages
Output
Modules
Process alerts and logs and
generate a final output
Figure 1 shows the Snort IDS rules
generator procedure. The association rules of
the defined parameter’s entries are used to
generate the Snort IDS rules by the MinSIC
module for detecting network probe attacks.
Figure 1 Snort IDS generator rules
The Snort IDS rules exhibitions were
assessed by utilizing the precision
comparisons method. Appropriate
parameters, as seen in Table 2, layout the
Grunt IDS rules as appeared in Figure 1.
C. Scanning
Port scanning is a process of finding out
which ports are open on a particular host or all
hosts on a network[9]. The first step in any
intruder activity is usually to find out what
services are running on a network. Once an
intruder has found this information, attacks
for known vulnerabilities for these services
are tried. The portscan preprocessor is
designed to detect port scanning activities.
The preprocessor can be used to log the port
scanning activities to a particular location in
addition to standard logging. Hackers can use
multiple port scanning methods. Refer to man
pages or documentation of the Nmap utility
[10] to learn more about port scanning
methods. The Nmap utility is a widely used
tool for port scanning.
The following is the general format of the
preprocessor used in the snort.conf file.
preprocessor portscan: