VirtualLaboratoryIntrusionDetectionExperienceforInformationSystemsProfessionals.docVIP

Virtual Laboratory Intrusion Detection Experience for Information Systems Professionals Valerie J. Harveyharvey@Computer and Information Systems, Robert Morris UniversityMoon Township, PA 15108 USA Randall Johnsonjohnsonr@Technical Services, Information Systems, Robert Morris UniversityMoon Township, PA 15108 USA John C. Turchekturchek@Computer and Information Systems, Robert Morris UniversityMoon Township, PA 15108 USA Abstract This paper describes how to design and implement an intrusion detection module that may be implemented in various courses taught in an information system curriculum and covers the industry-standard Snort Open Source intrusion detection system (IDS). This paper proposes that virtualization offers three significant instructional advantages in delivering a rich IDS experience: (1) server independence giving each student control of an IDS configuration, (2) a unique IP address on the “virtual” network for each server so that students are able to work in teams, including in distance learning situations, and (3) demonstration of centralized logging as typically deployed in production networks by configuring each virtual machine to send log messages to the instructor’s virtual machine. Students then can generate, observe, log, and analyze various types of network traffic between their virtual servers in a safe, ethical manner. Keywords: intrusion detection, Snort, virtualization, information security INTRODUCTION AND RATIONALE This paper describes how to design and implement an intrusion detection module that may be implemented in various courses taught in an information system curriculum or in a specific information security curriculum. Such a module is suitable for use in courses at both the undergraduate and graduate levels. With respect to model I/S curricula, the module may be used with IS2002.6 Networks and Telecommunication and MSIS 2000.3 Data Communications and Networking. With respect to model curriculum for information security