Network Intrusion Detection System Based on Embedded System

This research is a new attempt in the NIDS designing methods. Off-line NIDS is designed and then developed to an on-line NIDS. The required tools and sub-systems for developing the off-line to on-line NIDS are built: Tapping system Real-time Operation System (RTOS) and the Packet Feature Extractor (PFE). The attempt succeeded and gave a good result. A new method is used to design the off-line NIDS. The designing was based on Simulink Images Block Matching (IBM) and Embedded Matlab Function (EMF). To ensure that the NIDS will receive all the network events a network tapping system is designed and implemented. The system is designed based on embedded Linux Vyatta. The designed system is implemented in modern embedded appliances that is BIS-6660. The RTOS is built to be an environment where the designed on-line NIDS will be implemented.The RTOS is created based on xPC Target Kernel with size equal to 1.4 MB. The PFE is designed by using C#.Net programing language and formed in Simulink C function block to be connected with the NIDS sub-blocks.The PFE is connected with the on-line NIDS sub-blocks and implemented after both are embedded in the RTOS that was created for this issue.