SNORTIK : uma integração do IDS SNORT e o sistema de firewall do MIKROTIK ROUTEROS.

Abstract

Intrusion Detection Systems (IDS) are tools designed to improve security in operating systems and computer networks. These systems are intended to identify attack attempts to the structure that they are designed to monitor, and generate alerts to the system/network administrators so that the appropriate action to solve the problems can be taken. An IDS can also be integrated with other protection mechanisms, such as a firewall, in order to react to an attack. Although the possibility of integration with a firewall, natively, it is possible only using addons, also known as plugins. This integration between IDS and firewall is not something universal and compatible with any and all firewall system, such as the Mikrotik RouterOS. To accomplish this integration, an intermediate system is proposed. This work proposes the implementation of SNORT IDS as an attack detection tool and the development of an intermediate system that uses the logs generated by SNORT IDS to create protection rules for the Mikrotik RouterOS firewall. The achieved results show that this system can be used to automate the reaction process to attacks identified by SNORT without the system administrator intervention, blocking suspect hosts identified.