Assessing the Effectiveness of Snort in Detecting Malicious URLs

Simple item page
dc.contributor.authorZuva, Simbarashe
dc.contributor.supervisorTraore, Issa
dc.contributor.supervisorWougang, Isaac
dc.date.accessioned2023-08-29T10:44:01Z
dc.date.available2023-08-29T10:44:01Z
dc.date.copyright2023en_US
dc.date.issued2023-08-29
dc.degree.departmentDepartment of Electrical and Computer Engineeringen_US
dc.degree.levelMaster of Engineering M.Eng.en_US
dc.description.abstractWeb attacks have been on the rise in recent years, and organisations are constantly searching for new and better ways to detect and block the corresponding attack vectors. Some of the prominent attributes of web attack vectors are malicious domains used to trigger or sustain these attacks, for instance, through launching phishing attacks or by hosting command and control (C&C) infrastructures. Detecting accurately and blocking the malicious domains has become increasingly difficult due to the evasive techniques used by the attackers to mask their activities by emulating legitimate network traffic to an accurately high degree and through tactics such as domain generation algorithms (DGA) and fast flux DNS. Snort, an open-source intrusion detection system, has traditionally been utilized to detect network intrusions through network traffic signature analysis. However, while snort has subsequently been upgraded to enable the detection of web attacks, its effectiveness in detecting malicious domains is questionable because of the coarse-grained nature of web attack signatures. At the same time, it is a reasonable proposition to assume that there would be an implicit relation between granular attacks and the usage/occurrence of malicious domains. In this project, a platform is developed to explore and assess experimentally the ability of snort in detecting malicious domains. The proposed approach extracts some useful indicators of compromise (IoC) from the granular Snort alerts triggered by web visits and leverage such information to establish whether the corresponding URLs are benign or malicious. The platform was built around a headless chrome browser and the pfSense open-source firewall which has a built-in snort engine. The experimental evaluation, conducted using a public dataset of benign and malicious domains, yielded important insights into the strengths and limitations of snort in detecting malicious domains, and helped identify directions for future improvements.en_US
dc.description.scholarlevelGraduateen_US
dc.identifier.urihttp://hdl.handle.net/1828/15296
dc.language.isoenen_US
dc.rightsAvailable to the World Wide Weben_US
dc.subjectMalicious domainen_US
dc.subjectLegitimate domainen_US
dc.subjectIntrusion Detectionen_US
dc.subjectSnorten_US
dc.subjectpfSenseen_US
dc.subjectWiresharken_US
dc.subjectSnort Alertsen_US
dc.titleAssessing the Effectiveness of Snort in Detecting Malicious URLsen_US
dc.typeprojecten_US

Files

Original bundle
Now showing 1 - 2 of 2
Thumbnail Image
Name:
Zuva_Simbarashe_MEng_2023.pdf
Size:
1.93 MB
Format:
Adobe Portable Document Format
Description:
Project Report
Download
No Thumbnail Available
Name:
Zuva_Simbarashe_MEng_2023.zip
Size:
75.49 MB
Format:
Compressed Archive File
Description:
Project Files
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
2 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

Graduate Projects (Electrical and Computer Engineering)
 
University of Victoria Libraries

We acknowledge and respect the Lək̓ʷəŋən (Songhees and Esquimalt) Peoples on whose territory the university stands, and the Lək̓ʷəŋən and W̱SÁNEĆ Peoples whose historical relationships with the land continue to this day.