Skip to content

Latest commit

 

History

History
31 lines (22 loc) · 1.55 KB

README.adoc

File metadata and controls

31 lines (22 loc) · 1.55 KB

PROJ201 - Installation Manual NIDS & HIDS Malware lab

This repository contains the installation manual of a NIDS & HIDS malware lab, this malware lab is used in a research project carried out during an internship.

The manual can be user-friendly (HTML version) viewed here, a PDF-version is available here.

Description

This repository contains a manual for installing a Malware Lab environment. The Malware lab is intended for a research project to compare the detection difference between a NIDS and HIDS. The aim of the research was to advise small and medium-sized enterprises if network detection (NIDS) sufficient is to detect malware infection in a enterprise network or that End-Point detection (HIDS) is necessary. The results of the research can be found here.

The manual is subdivided in to the following parts:

  • Installation & Configuration of:

    • VMware Workstation Pro

    • PFSense

    • Windows 10 VM (Victim Machine)

    • HIDS (Ubuntu Server 18 with Wazuh)

    • NIDS (Ubuntu Server 18 with Snort & Suricata)

  • Last configuration to combine these VM’s

The design of the malware lab:

Malware Lab Infrastructure
Figure 1. Malware Lab Infrastructure

Wazuh is during the research enriched with Sigma rules, the converted Wazuh rules can be found in the sigWah repository