Scientific paper ID 1470 : 2017/3

Intrusion detection systems are mostly software tools that monitor computer systems and networks for malicious actions or violate rules for normal network operation. Any detected activity or violation is typically analyzed by the network administrator or centrally collected by an event security management system. These systems diagnose traffic and, through their filtering techniques, alert themselves to malicious activity, also trying to limit real from false alarms.

University networks are particularly vulnerable to intrusion, both internally and externally. They can be used for malicious actions, and network control and management is in most cases low budget. All this makes these issues particularly relevant and the solution must be adequate and effective.

This article presents the implemented Snort information system and specific features of the academic network of Todor Kableshkov University of Transport for intrusion detection as well as the information security management system used.