Implementação de um sistema de detecção de intrusão de redes de computadores na rede local de ensino

Abstract

This work describes a implementation and tests of a network intrusion detection system in the local teaching network of the informatics department of the Technological Federal University of Paraná, using a Debian Linux server as a passive sensor connected in promiscuous mode in the main switch, the Snort tool integrated with MySQL database, and the AcidBase web console. Four tests were performed in this implementation using penetration testing techniques.The work also covers a theoretical background about the intrusion detection systems, its main characteristics, its benefits and drawbacks, types (based in host, based in network, and hybrids), methodologies of detection (based in knowledge and based in behavior), and network position.