 |
It is necessary to establish a corresponding testing environment and test the results with appropriate tools to validate whether the snort rule generator produces snort rules that can be detected effectively.
In this study, the testing environment is Kali Linux. The testing process is illustrated in the figure. In this procedure, the sender transmits packets to the receiver, where the receiver uses the snort-generated firewall to inspect these packets. It takes appropriate actions based on preconfigured rules for the payload. The sender utilizes a Python script written with Scapy to generate attack packets and send them to the receiver, simulating the behavior of an attacker. If Snort detects the malicious packet, it will alert the receiver and prevent the malicious packet from going through the firewall.
|
IEEE/ICACT20240269 Slide.18
[Big Slide]