Analysis Console for Intrusion Databases Roy. Description ACID.
-
date post
19-Dec-2015 -
Category
Documents
-
view
247 -
download
1
Transcript of Analysis Console for Intrusion Databases Roy. Description ACID.
ObjectiveObjective
Setup ACID, MySQL, SnortSetup ACID, MySQL, Snort Super alert AnalyzerSuper alert Analyzer Performance Benchmarking of ACIDPerformance Benchmarking of ACID
About ACIDAbout ACID
Query-builder and search interface
Packet viewer (decoder) Alert
management
Chart and statistics generation
Centralize control
PrerequisitesPrerequisites A databaseA database
- Package: MySQL Package: MySQL • Version: 3.23.x+ Version: 3.23.x+ • Homepage: Homepage: http://www.mysql.com/http://www.mysql.com/
A mechanismA mechanism- Package: Snort Package: Snort
• Version: 1.7+ Version: 1.7+ • Homepage: Homepage: http://http://www.snort.orgwww.snort.org//
- Package: PHP Package: PHP • Version: 4.0.4+ Version: 4.0.4+ • Homepage: Homepage: http://http://www.php.netwww.php.net//
A web serverA web server- Package: Apache Server Package: Apache Server - Version: 1.3.*+ Version: 1.3.*+ - Homepage: Homepage: http://http://www.apache.orgwww.apache.org//
PHP access database APIPHP access database API- Package: ADODB Package: ADODB
• Homepage: Homepage: http://http://php.weblogs.com/adodbphp.weblogs.com/adodb//
- Package: PHPlot Package: PHPlot • Homepage: Homepage: http://http://www.phplot.comwww.phplot.com
- Package: JPGraph Package: JPGraph • Homepage: Homepage: http://http://www.aditus.nu/jpgraphwww.aditus.nu/jpgraph//
- Package: GD Package: GD • Homepage: Homepage: http://http://www.boutell.com/gdwww.boutell.com/gd//
Install ACID and snortInstall ACID and snort
Download ACIDDownload ACID- http://www.andrew.cmu.edu/user/rdanyliw/http://www.andrew.cmu.edu/user/rdanyliw/
snort/snortacid.htmlsnort/snortacid.html Decompress acid-0.9.6b23.tar.gzDecompress acid-0.9.6b23.tar.gz
Move ACID to your web directoryMove ACID to your web directory
Setting up the database in MySQLSetting up the database in MySQL
Create databaseCreate database
Create user and assign privilegeCreate user and assign privilege
Create snort tablesCreate snort tables
Connect to sensor managerConnect to sensor manager
Open Open http://192.168.1.101/acid/acid_conf.phphttp://192.168.1.101/acid/acid_conf.php
Setup snort output moduleSetup snort output module
Edit /etc/snort/snort.confEdit /etc/snort/snort.conf
Test environmentTest environment
Internet
Name: ACID serverOS:LinuxIP:192.168.1.101Net Mask:255.255.255.0Gateway:192.168.1.2
Web Server: Apache 2.051SQL Server: MySQL 4.0.20Sensor: Snort 2.1.3Management: ACID 0.9.6 beta 23
Name: attacker1OS:WindowsIP:192.168.1.1Net Mask:255.255.255.0
Vulnerability Scanner: N-Sealth 5.2
三暝三日…
More analysisMore analysis
5 most frequent alerts (alert listing)5 most frequent alerts (alert listing) 15 most frequent alerts (unique source)15 most frequent alerts (unique source) Time profile of alertsTime profile of alerts Last 24 hoursLast 24 hours Last 72 hoursLast 72 hours
Performance Benchmarking of Performance Benchmarking of ACID (Page loading time) ACID (Page loading time)
Host:Host: Intel Mobile 800Mhz, 256 MB RAM Intel Mobile 800Mhz, 256 MB RAM OS:OS: Linux 2.2.16-22 Linux 2.2.16-22 Apache:Apache: 1.3.19 1.3.19 PHP:PHP: 4.0.5 4.0.5 MySQL:MySQL: 3.23.32 3.23.32 PostgreSQL:PostgreSQL:7.1.27.1.2 DB schema:DB schema: v102 v102 ACID:ACID: 0.9.6b10 - 0.9.6b13 0.9.6b10 - 0.9.6b13
ReferenceReference
Performance Benchmarking of ACIDPerformance Benchmarking of ACID- http://www.andrew.cmu.edu/user/rdanyliw/http://www.andrew.cmu.edu/user/rdanyliw/
snort/perf/acid_perf.htmlsnort/perf/acid_perf.html NIST Intrusion Detection SystemNIST Intrusion Detection System