SecSim : Network simulator for generating intrusion detection system rules

Abstract

Network Security is core area of interest after enhancements in networks. Due to these enhancements, one can easily attempt malicious activities from any corner of world against any network. In order to protect a network from such activities and illegitimate access SecSim generates sensor alert data and detection rules for network administrator to ensure security in a network. The scope of SecSim is to cover four major network attacks which contains severe effects for any network but can be generated by a novice user. These attacks are Denial of Service (DOS), IP spoofing, TCP flooding and ICMP flooding. SecSim provides security by designing and using simulated network and then performs simulated cyber attacks on that network and generates sensor alerts and detection rules in result for any input network topology. In future work, SecSim will be enhanced by using other cyber attacks so that it can provide network security against any cyber invasion.