А Graph Database Intrusion Detection and Prevention System

Abstract

Network threats are perceived as a serious and current problem due to the presence of different types of attacks, the purpose of which is to penetrate the security of a certain system using vulnerabilities and fraud techniques. They can appear anywhere, making them more difficult to detect and prevent. The victims of such type of attacks are constantly increasing, resulting in great losses not only in financial terms, but also in breaches of data privacy and business processes. As a result, protecting confidential information from unpredictable attacks has become a pressing issue and a difficult task that would be impossible without the help of intrusion detection systems (IDS) and intrusion prevention systems (IPS). The goal of the paper is to propose and design general architecture and implement a prototype for protection of an existing network of devices by detecting and preventing threats through the extraction and analysis of information from the devices located in the network, with the necessary data being stored in a graph database offering the possibility of visualization. To implement device network protection, it is necessary to enable software tools that, based on certain rules, impose restrictions on devices on the network and prevent future malicious actions.