1.1 Introduction
An Intrusion Detection and Prevention System (IDPS) is a critical component of cyber security infrastructure designed to monitor network or system activities for malicious or unwanted behavior. Its primary function is to identify and respond to potential security threats in real-time, aiming to protect systems and data from unauthorized access, misuse, or exploitation (Pandey, 2019). IDPS operates through a combination of signature-based detection, anomaly detection, and heuristic analysis techniques. Signature-based detection involves comparing network traffic or system activities against a predefined database of known attack patterns or signatures. Anomaly detection, on the other hand, focuses on identifying deviations from normal behavior, which may indicate suspicious activities. Heuristic analysis employs algorithms to detect previously unseen threats based on behavior patterns.
As a prelude to other parts of this study, this chapter will discuss the background upon which this study was initiated, the statement of problems that led to this study, the Aim and Objectives of the study. Others are Significance of the study, Scope of work, Limitation of the study and Definition of technical terms.
1.2 Background of Study
In today's interconnected digital landscape, the security of computer networks and systems is of paramount importance. With the increasing sophistication and frequency of cyber threats, organizations face significant challenges in safeguarding their sensitive data and resources from malicious actors. Intrusion Detection and Prevention Systems (IDPS) emerge as vital components in the arsenal of cyber security measures, aiming to proactively identify and mitigate potential security breaches.
Northcutt, S., et al. (2013) asserted that by continuously monitoring network traffic, system logs, and other relevant data sources, an IDPS can detect various types of threats, including malware infections, unauthorized access attempts, denial-of-service attacks, and insider threats. Upon detection, the system can take automated actions such as blocking malicious traffic, alerting security personnel, or initiating incident response procedures.
Skoudis et al., (2014), effective implementation of an IDPS requires careful configuration, tuning, and ongoing maintenance to minimize false positives and negatives while maximizing detection accuracy and responsiveness. Additionally, integration with other security controls such as firewalls, antivirus software, and security information and event management (SIEM) systems enhances overall cyber security posture (Skoudis et al., 2014).
The proliferation of network-enabled devices, the rise of cloud computing, and the expansion of remote work have expanded the attack surface for cyber threats. Consequently, traditional security measures such as firewalls and antivirus software are no longer sufficient to defend against evolving threats. IDPS offers a proactive defense mechanism, capable of detecting and responding to both known and unknown security incidents in real-time. The growing reliance on digital technologies across various industries underscores the urgency of enhancing cyber security measures. From financial institutions to healthcare providers, organizations must adopt robust security solutions to safeguard sensitive data, preserve operational continuity, and maintain customer trust. IDPS represents a critical line of defense against cyber threats, providing organizations with the ability to detect and thwart attacks before they cause significant harm (Smith, 2020).
Numerous studies have explored different aspects of IDPS, including its architecture, detection techniques, performance evaluation, and real-world deployment. Researchers have proposed various approaches to enhance the effectiveness and efficiency of IDPS, such as machine learning algorithms for anomaly detection, collaborative intrusion detection schemes, and integration with threat intelligence feeds. Furthermore, studies have examined the practical challenges associated with deploying and managing IDPS in complex network environments. Issues such as false positives, scalability, integration with existing security infrastructure, and compliance requirements have been subjects of investigation, aiming to provide insights into best practices for successful IDPS implementation (Smith, 2020).
1.3 Statement of Problem
The following problems were identified in the existing system that necessitated the development of the intrusion detection and prevention system:
- Absence of an intrusion detection and prevention system.
- Insecurity of customer information.
- Low level of file security.
- Inability to prevent intruders from gaining access to sensitive information stored in the computer system.
Furthermore, one of the primary challenges facing IDPS is the issue of false positives and false negatives. False positives occur when legitimate activities are incorrectly flagged as malicious, leading to unnecessary alerts and operational overhead. Conversely, false negatives occur when actual attacks go undetected, leaving systems vulnerable to exploitation. Achieving a balance between detection accuracy and minimizing false alarms remains a significant challenge for Intrusion Detection and Prevention System (IDPS) developers.
1.4 Aim and Objectives of the Study
The aim of the study is to design and implement an Intrusion Detection and Prevention System. In achieving this aim, the following specific objectives were laid out as follows:
- To develop a system that will require an encryption key before bank transaction information can be viewed;
- To design a system that will encrypt information pertaining to customers to prevent intrusion; and
- To implement a system that will prevent disclosure of customers’ data to fraudsters by utilizing cipher text.
1.5 Significance of Study
The implementation of intrusion detection and prevention system proposed system is significant in the following ways:
- It will help prevent unauthorized individuals (intruders) from gaining access to the financial information of customers.
- It will help in tightening the security level of the organization.
- The study will reveal how encryption can be applied to prevent intruders from gaining access to customer information.
- The study will serve as a useful reference material to other researchers seeking related information.
1.6 Scope of Study
The scope of the research is focused on the design and implementation of an Intrusion Detection and Prevention System using Gufax micro finance Bank Plc, Ikot Ekpene as a case study. It is limited to the use of cipher text encryption to prevent intruders from gaining access to vital information of customers.
1.7 Limitations of the Study
During the course of this study, many things militated against its completion, some of which are:
- Time Constraint: The time frame given to accomplish this project was very short due to school academic calendar and it was carried out under pressure which made the researcher not to implement some necessary features.
- Establishment Policies: Establishment policies posed a serious limitation as most staffs are not ready to release information needed for this research work. There were lots of information needed from the staffs of this institution to enhance the study which took them time to release or they did not release at all for security purposes, hence the scope was reduced.
- Financial Constraint: Insufficient fund tends to impede the efficiency of the researcher in sourcing for the relevant materials, literature or information and in the process of data collection (internet).
1.8 Definition of Terms
Intrusion:
It is defined as deception deliberately practiced with a view of gaining an unlawful or unfair advantage.
Detection:
It is the extraction of particular information from a larger stream of information without specific cooperation from or synchronization with the sender.
