Authors:
Gerardo Canfora
1
;
Antonio Pirozzi
2
and
Aaron Visaggio
1
Affiliations:
1
University of Sannio, Italy
;
2
Koine srl, Italy
Keyword(s):
Intrusion Detection System, Intrusion Prevention System, IPtables, Snort, NIDS, NIPS, Application-level Control Flow, Netfilter.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Network Security
;
Wireless Network Security
Abstract:
Since each organization has its own security culture and background, there is not an out-of-the-box solution
that fits all the possible security requirements. There may be some contexts in which it is necessary to monitor
and prevent certain application-level attacks with less impact on pre-existent configuration. For example, there
may be some constraints on processing resources of some embedded devices. Starting from this consideration,
we developed s2ipt, a python-powered tool which aims to implement a lightweight Netfilter-based network
intrusion detection and prevention system (IDS/IPS) by translating Snort community rules into iptables rulesset.
s2ipt utilizes the netfilter string matching module to detect application-level attacks. Netfilter reduces
the impact on a system, has less memory and CPU footprint, which makes it suitable to run even on low-cost
devices than a solution like Snort. s2ipt allows iptables to detect application layer attacks in a transparent way,
in fact it only adds new application layer ruleset leaving the existing ones unchanged.
(More)