REMOTE INTRUSION RESPONSE SYSTEM USING TELEGRAM BOT - Shahadan Saad,; Muhammad Syahid Farhan Mohd Jeman,; Adib Farhan Azzemi,; Ahmad Firdaus Ahmad Fadzil,; Albin Lemuel Kushan,; Raihana Md Saidi, (Journal of Islamic, Social, Economics and Development, 2021)
Nowadays, network security became a vital part element in building networkinfrastructure. To fulfil that, a network administrator needs to deploy a monitoring system suchas Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) to alert themwhenever an intrusion takes place. However, the implementation of IDS is so passive that itdoes not provide a platform for the network administrator to respond and managed remotely.Meanwhile, IPS would blindly block all suspicious alerts despite the legitimacy of the alert. Asystem has to be developed to give more options for the network administrator in deciding theresponse to incoming threats and flexibility for the network administrator to monitor andrespond at the same time. Therefore, this project proposes the development of IntrusionResponse System (IRS) that can be managed remotely using Python and Telegram Bot, andevaluation of the network performances via Remote Intrusion Response System (RIRS). Theconfiguration and development of the project involve a network environment that is created foran experimental testing purpose that consisted of a switch, IRS host, and FTP host, and webserver host. A Python script is developed using Snort and Iptables to generate the alert andblocking the intrusion via Telegram Bot. Several common intrusions were emulated to thetargeted host to test the effectiveness of the system. Multiple network parameters such as delay,network, bandwidth, and jitter corresponding to the implementation of RIRS and SYN Floodattack were recorded and showed there are no backlashes detected on the networkperformances and SYN flood did not limit the main function of RIRS. In addition, RIRS onlyrequired minimal milliseconds in responding to the attacks while notifying the admin in a matterof second. This indicated that RIRS can be considered a very attractive alternative for networkadministrator or SOHO environment network user that wants to secure their networkinginfrastructure.