A HYBRID COMPUTER IMMUNE (INTRUSION DETECTION/PREVENTION) SOFTWARE

A software that can serve as both Host IDS/IPS and Network IDS/IPS. It detects intrusion using: 1. signature based intrusion detection method 2. Anomaly based intrusion detection method 3. Policy based intrusion detection method The software can prevent intrusion by automatically: 1. blocking the ports and/or IP address involved 2. Resetting the network connections 3. if all above fails, as last result, let the software shut down the system. 3 User accounts are created: 1. Administrator's account 2. Network Analyst 3. Attendant The software triggered alerts are: 1. Sent via email to administrator's email address. 2. An alert sound is played to notify the personnel on sit. The alerts are logged in MySQL database. The software has a web-front end that can used for real-time monitoring, configuration settings and general maintenance. Alerts can be viewed on the web-front end also, with some prevention support for the administrator on the web-interface. ...Policies are set by the administrator only. ...Signatures are set by the administrator only. ...Training of the anomaly sensor is carried out by the administrator. Accompanying this software must be: 1. A system analysis and design of the software 2. A system testing report achieved by testing the software with DARPA set 1999 and real-time network packets 3. Source code 4. Help and Installation documentations Suggestion: You can either use statistical or neural network for the anomaly detection part of the project. ADVICE: Check SNORT, SPADE, BASE, MATLAB's NEURAL NETWORK TOOLBOX and IDS CENTER for guidance and more information as to how to develop this software. familiarity with these software can aid final output.