Design and implementation of intrusion detection and prevention approaches for information systems

In the IT world, on individual and institutional sense, fast and secure retrieval of stored digital information has become very essential. It's important here to prevent unauthorized access of vital stored information. It is an obligation for institutions and corporates to take precaution for ensuring the privacy of confidential of information. One of the practiced precautions is the Intrusion Detection and Prevention Systems (IDPS). In this thesis, IDPSs have been thoroughly investigated and the literature up-to-date on this topic has been examined. In this study, based on our research investigation, we propose a hybrid approach which combines honeypots and IDPSs. The proposed hybrid approach combines the advantages of high and low interaction honeypot system to overcome the biggest drawback, the false alarms, of IDPS. The developed honeypot-based IDPS architecture enables a central control by a special designed software switch to provide least cost and highest performance in a LAN that deploys VLAN. Besides, a special software is developed for ensuring the log fıles security. This software is adaptable for the Act 5651 in Turkish law and prevents the unauthorized access or change in the log files. The developed system guarantees the integrity of log files so that they can be used as objective evidence for digital forensics process. To verify the usability of the developed system, the system has been successfully tested in a cloud computing environment on a private networks. In particular, honeypot-based system combined with IDPS detects malicious activities based on package, type and location; thus, it is very useful for both individuals and institutions as response for security needs. After testing the developed system, on different location scenarios, it is recommended to apply the developed system for enterprise campus networks using different localization which in turns reduces the installation, maintenance and management costs. Honeypot systems implemented with IDPS and applied for network traffic mapping create a special security architecture for large enterprise campus network and cloud computing environment.