Towards Detection of Network Attacks by Snort Analysis Using Machine Learning Techniques

Network analysis is a crucial process in identifying suspicious entities and the sequence of actions in an attack scenario. Among the various types of attacks, flooding attacks on web servers are particularly detrimental, causing bandwidth loss and server overload. To detect such attacks, Intrusion Detection Systems (IDS) such as Snort and Wireshark are commonly used. These systems capture traffic in the networked environment, enabling the creation of I/O graphs and flow graphs, and alert rules are generated based on various protocols like TCP/IP and ICMP. The alerts are then used to generate a log file, which are analyzed using machine learning models such as the Naive Bayes model. By analyzing the obtained data from the Naive Bayes model, reliable accuracy can be achieved in detecting network flooding attacks.