2023
doi: 10.12720/jait.14.4.616-624
Detecting Unusual Activities in Local Network Using Snort and Wireshark Tools
Naif Alsharabi1,2,*
,
Maha Alqunun1 ,
Belal Abdullah Hezam Murshed2,3
- 1Department of Computer Engineering, College of Computer Science and Engineering, University of Ha’il, Ha’il 55476, Saudi Arabia
- 2Department of Computer Science, College of Engineering and IT, Amran University, Amran 00967, Yemen
- 3Department of Studies in Computer Science, Mysore University, Mysore-570006, Karnataka, India
- Manuscript receivedOctober 27, 2022
- revisedDecember 9, 2022
- acceptedMarch 31, 2023
- publishedJuly 5, 2023
Abstract
Many organizations worldwide encounter security risks on their local network caused by malware, which might result in losing sensitive data. Thus, network administrators should use efficient tools to observe the instantaneous network traffic and detect any suspicious activity. This project aims to detect incidents in local networks based on snort and Wireshark tools. Wireshark and snort tools combine their advantages to achieve maximum benefit, enhance the security level of local networks, and protect data. Snort Intrusion Detection System (Snort-IDS) is a security tool for network security. Snort-IDS rules use to match packet traffic. If some packets match the rules, Snort-IDS will generate alert messages. First, this project uses a virtual dataset that includes normal and abnormal traffic for the performance evaluation test. In addition, design local rules to detect anomalous activities. Second, use Wireshark software to analyze data packets. Second, use Wireshark software to analyze data packets. This project categorizes the detected patterns into two groups, anomaly-based detection, and signature-based detection. The results revealed the efficiency of the snort-IDS system in detecting unusual activities in both patterns and generating more information by analyzing it by Wireshark, such as source, destination, and protocol type. The promoted experience was tested on the virtual local network to ensure the effectiveness of this method.
Keywords
- network
- intrusion detection system
- wireshark
- snort
- anomaly-based
- detection
- signature-based detection
- packet traffic
- alert
How to Cite
Naif Alsharabi, Maha Alqunun, and Belal Abdullah Hezam Murshed, "Detecting Unusual Activities in Local Network Using Snort and Wireshark Tools," Journal of Advances in Information Technology, vol. 14, no. 4, pp. 616-624, 2023. https://doi.org/10.12720/jait.14.4.616-624
Copyright & License
Copyright © 2023 by the authors. This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited (CC BY 4.0).
