5DVSEHUU\3LYH6QRUWLOH62+21HWZRUNOHUGH%LU

*YHQOLN'XYDUÕ8\JXODPDVÕ
$)LUHZDOO$SSOLFDWLRQRQ62+21HWZRUNVZLWK5DVSEHUU\3LDQG6QRUW

0XVWDID&RúDU 6XLNXP.DUDVDUWRYD
%LOJLVD\DU0KHQGLVOL÷L (OHNWURQLNYH2WRPDV\RQ
+LWLWhQLYHUVLWHVL +LWLWhQLYHUVLWHVL
dRUXP 7UNL\H dRUXP7UNL\H
PXVWDIDFRVDU#KLWLWHGXWU VXLNXPNDUDVDUWRYD#KLWLWHGXWU

Özetçe² .oN YH RUWD |OoHNOL RILV ELOJLVD\DU D÷ODUÕQGD RODQWHPHOELOHúHQOHUDUDVÕQGDDQWLYLUV\D]ÕOÕPODUÕLOHJYHQOLN

VDOGÕUÕ WHVSLW VLVWHPL 676 GHYUH\H DOÕQDUDN RODVÕ VDOGÕUÕODUD
PGDKDOH HGLOHELOLU $÷ WUDIL÷LQLQ DQDOL] HGLOPHVL VDOGÕUÕ WHVSLW
\|QWHPOHULQLQ WHPHOLQL ROXúWXUPDNWDGÕU 6DOGÕUÕ WHVSLW VUHFLQGH
GRQDQÕP YH \D]ÕOÕP o|]POHUL D\UÕ D\UÕ RODELOHFH÷L JLEL ELUOLNWH
RODQ VLVWHPOHUGH EXOXQPDNWDGÕU .oN YH RUWD |OoHNOL D÷ODUGD
EX VLVWHPOHUL EDUÕQGÕUPDN PDOL\HWOL YH ]DKPHWOL ELU \DWÕUÕP
RODUDNGH÷HUOHQGLULOGL÷LLoLQJHQHOOLNOHLKPDOHGLOHELOPHNWHGLU%X
GH]DYDQWDMOÕGXUXPXDúPDNDPDFÕ\OD5DVSEHUU\3LELOJLVD\DUODU
LOH DoÕN ND\QDN NRGOX 6QRUW YH 6WUDWD 676¶OHUL ELUOLNWH
NXOODQÕODELOLU %X oDOÕúPDGD NoN |OoHNOL ELU D÷ ]HULQGH
5DVSEHUU\ 3L FLKD] KD]ÕUODQDUDN ]HULQH NXUXODQ VQRUW 676
PRGOLOHELUD÷WUDILNDQDOL]LX\JXODPDVÕ\DSÕOPÕúWÕU*HOLúWLUHQ
VLVWHPLQGHYUH\HDOÕQPDVÕLOHD÷]HULQGHJHUHNVL]ED]ÕWUDILNOHULQ
ROXúWX÷XWHVSLWHGLOPLúWLU
Anahtar Kelimeler— A÷ Güvenli÷i, Güvenlik duvar, Raspberry
Pi, Snort, STS
GXYDUÕ |]HOOLNOHULQH VDKLS VLVWHPOHU JHOPHNWHGLU $÷ ]HULQGH
JYHQOL ELU LOHWLúLPLQ VD÷ODQPDVÕQÕQ \DQÕ VÕUD WRSODP EDQW
JHQLúOL÷LQLQ YHULPOL NXOODQÕOÕS NXOODQÕOPDGÕ÷ÕQÕQ DQDOL]LQLQ
\DSÕOPDVÕ GD |QHPOL ELU NRQXGXU %X QHGHQOH D÷ WUDIL÷LQLQ
L]OHQHUHN KHP JYHQOLN VD÷ODQÕUNHQ KHP GH SHUIRUPDQV
DUWÕUÕODELOLU
øQWHUQHWWHNQRORMLOHULQLQJHOLúLPLLOHELUOLNWHWHNQLNDQODPGD
D÷ FLKD]ODUÕQD YH VXQXFXODUD VDOGÕUÕODU GD DUWPDNWDGÕU %X
VDOGÕUÕODU KL]PHW GXUGXUPD YHUL oDOPD L] EÕUDNPD YH ]DUDU
YHUPH úHNLOOHULQGH NDUúÕPÕ]D oÕNPDNWDGÕU %X VDOGÕUÕODUÕ
EHUWDUDIHGHELOPHNLoLQD÷WUDIL÷LQLQDQDOL]HGLOHUHN,3YHSRUW
ED]OÕ ELU JYHQOLN GXYDUÕ oDOÕúWÕUÕOPDVÕ JHUHNPHNWHGLU %X
JYHQOLN GXYDUODUÕQÕQ ELUoRN PRGOOHUL EXOXQPDNWDGÕU %XQODU
DUDVÕQGDVDOGÕUÕWHVSLWYHVDOGÕUÕ |QOHPHVLVWHPOHULHQ|QHPOLOHUL
DUDVÕQGDGÕU
.oN YH RUWD |OoHNOL RILV 6PDOO+RPH 2IILFH62+2
Abstract² ,Q VPDOO DQG KRPH RIILFH 62+2 FRPSXWHU
QHWZRUNV DQ LQWUXVLRQ GHWHFWLRQ V\VWHP FDQ EH DFWLYDWHG WR
LQWHUFHSWWKHSRVVLEOHDWWDFN1HWZRUNWUDIILFDQDO\VLVLVWKHEDVLV
RI DWWDFN GHWHFWLRQ PHWKRGV ,Q WKH LQWUXVLRQ GHWHFWLRQ SURFHVV
ERWKKDUGZDUHDQGVRIWZDUHVROXWLRQVDUHDYDLODEOHDVZHOODVLQ
V\VWHPV WKDW DUH EXQGOHG WRJHWKHU +RVWLQJ WKHVH V\VWHPV LQ
62+2 QHWZRUNV LV XVXDOO\ QHJOLJLEOH EHFDXVH LW LV FRQVLGHUHG D
FRVWO\ DQG ODERULRXV LQYHVWPHQW ,Q RUGHU WR RYHUFRPH WKLV
ELOJLVD\DU D÷ODUÕQGD JYHQOLN VLVWHPOHULQLQ WHPLQL YH
\|QHWLOPHVL ]DPDQ PDOL\HW YH ELOJL DQODPÕQGD ROGXNoD \N
JHWLUPHNWHGLU %X QHGHQOH SUDWLN o|]POHULQ JHOLúWLULOPHVL
JHUHNPHNWHGLU g]HOOLNOH GRQDQÕP SDNHWL RODUDN VDWÕODQ
JYHQOLN GXYDUODUÕQÕQ IL\DWÕ YH \|QHWLPL ]RU RODELOPHNWHGLU
8FX] PDOL\HWOH EX VLVWHPOHULQ JHOLúWLULOPHVL YH NXOODQÕPÕ
DUWPDNWDGÕU>@
GLVDGYDQWDJHRSHQVRXUFHFRGH,QWUXVLRQ'HWHFWLRQ6\VWHPV,'6
VXFK DVVQRUWDQGVWUDWD FDQ EHXVHGWRJHWKHUZLWKUDVSEHUU\SL
FRPSXWHUV,QWKLVVWXG\DUDVSEHUU\SLGHYLFHZDVSUHSDUHGRQD
VPDOO VFDOH QHWZRUN DQG D QHWZRUN WUDIILF DQDO\VLV DSSOLFDWLRQ
ZDV SHUIRUPHGZLWK WKH VQRUW ,'6 PRGXOH LQVWDOOHG RQ LW ,WKDV
EHHQ GHWHUPLQHG WKDW VRPH RI WKH PDOLFLRXV WUDIILF RQ WKH
QHWZRUNE\DFWLYDWHGGHYHORSLQJV\VWHP
Keywords— Network security, Firewall, Raspberry Pi, Snort,
IDS
, *ø5øù
%LOJLVD\DUYHD÷JYHQOL÷LVRQ\ÕOODUGDELOLúLPWHNQRORMLOHUL
NRQXODUÕDUDVÕQGD|QHPLQLDUWÕUPD\DGHYDPHWPHNWHGLU.LúLVHO
YHNXUXPVDOELOJLOHULQJYHQOL÷LQLQVD÷ODQDELOPHVLLoLQJHUHNOL
‹,(((
.DEOROX D÷ODU ]HULQGH EDVLW YH NDUPDúÕN \DSÕGD ELUoRN
676 X\JXODPDODUÕ JHOLúWLULOPLúWLU >@ gUQHN RODUDN NDUDU
D÷DoODUÕ YH GL÷HU \|QWHPOHU NDUúÕODúWÕUÕODUDN \DSÕODQ ELU
X\JXODPDGD >@ VDOGÕUÕ WHVSLW RODUDN L\L VRQXoODU YHUPLúWLU
$\UÕFD \DSD\ ]HND \|QWHPOHULQL X\JXOD\DUDN D÷ ]HULQGHNL
QRUPDO ROPD\DQ WUDIL÷LQ EHOLUOHQPHVLQL DPDoOD\DQ >@
oDOÕúPDGD|QHPOLED]ÕGXUXPODUYXUJXODQPÕúWÕU
$÷ ]HULQGH ,2 SRUWODUÕQD VDKLS DOJÕOD\ÕFÕ QHWZRUN
GRQDQÕPODUÕ LOH J|PO PLNUR LúOHPFLOL GúN HQHUML
JHUHNVLQLPL LOH VLVWHPOHU NRQXPODQGÕUÕODELOLU %X VLVWHPOHUH
5DVSEHUU\ 3L $UGXLQR YH ;%HH FLKD]ODUÕ |UQHN J|VWHULOHELOLU
%XGRQDQÕPODU]HULQHDOJÕODPDYHLúOHPHDOJRULWPDODUÕLOHELU
WDNÕP \D]ÕOÕP ELOHúHQOHUL HNOHQHUHN ELU JYHQOLN VLVWHPL
ROXúWXUXODELOLU>@

8%0.¶QG,QWHUQDWLRQDO&RQIHUHQFHRQ&RPSXWHU6FLHQFHDQG(QJLQHHULQJ 

 5DVSEHUU\3LLOHVDQDOVZLWFK]HULQGHQ\DSÕODQELUILUHZDOO C. Saldr Tespit Sistemi-STS
X\JXODPDVÕQGD >@ ,3 ED]OÕ N|W DPDoOÕ WUDILN ROXúWXUDQ ELU
,3¶QLQ HQJHOOHQHELOGL÷L J|UOPHNWHGLU 5DVSEHUU\ 3L YH 6QRUW
NXOODQÕODUDN WP D÷ WUDIL÷LQL ELU OLVWH \DSÕS D÷ÕQ GDKD JYHQOL
KDOHJHOPHVLQLVD÷ODQDELOLU>@$\UÕFD5DVSEHUU\3LLOH\DSÕODQ
ELU X\JXODPDGD KHU ELU NXOODQÕFÕQÕQ ROXúWXUGX÷X  .EV¶OLN
WUDILNLOHYHULWDEDQÕQJQON0%E\NO÷QHHULúWL÷LWHVSLW
HGLOPLúWLU>@
øQWHUQHW RI WKLQJV VLVWHPOHULQLQ JHOLúLPL QHWLFHVLQGH
5DVSEHUU\ 3L¶OH KRPH QHWZRUN PRQLWRULQJ X\JXODPDVÕ
VD\HVLQGH NROD\ YHULPOL YH GúN PDOL\HWOL EX VLVWHP LOH HY
LoHULVLQGHNL ,3 NXOODQDQ FLKD]ODUÕQÕQ OLVWHVL YH NRQWURO
VD÷ODQPÕúWÕU >@ $\UÕFD >@¶ GH KD]ÕUODQDQSURJUDPODQDELOLU
J|POELU676LOH]DUDUOÕSDNHWOHULQWHVSLWL\DSÕOPÕúWÕU
%X oDOÕúPDGD D÷ WUDIL÷LQLQ \R÷XQ YH oHúLWOLOLN LoHUGL÷L
QLYHUVLWHD÷ODUÕQGDNoN|OoHNOLELUJUXS]HULQGH5DVSEHUU\
3L ELOJLVD\DU ]HULQGH 6QRUW \D]ÕOÕPÕ LOH ,'6 PRGOQQ
JHOLúWLULOPHVL YH |UQHN ELU WUDILN DQDOL]LQLQ \DSÕODUDN VDOGÕUÕ
WHVSLWVLVWHPLQLQGHYUH\HDOÕQPDVÕVD÷ODQPÕúWÕU
dDOÕúPDQÕQELULQFLE|OPQGH 5DVSEHUU\3L 6QRUWYH ,'6
PRGO KDNNÕQGD WHPHO ELOJLOHUH \HU YHULOPLúWLU øNLQFL
E|OPGH 6QRUW ,'6 PRGOQQ NXUXODUDN |UQHN ELU JYHQOLN
GXYDUÕQÕQ KD]ÕUODQPDVÕ DQODWÕOPD\D oDOÕúÕOPÕúWÕU $UGÕQGDQ
NXUXODQVLVWHP]HULQGHNXUDOWDEDQOÕGHQHPHOHU\DSÕODUDNED]Õ
EXOJXODUHOGHHGLOPLúWLU6RQXoODUE|OPOHULQGHLVHoDOÕúPDGDQ
HOGHHGLOHQEXOJXODUDJ|UHED]ÕGH÷HUOHQGLUPHOHU\DSÕOPÕúWÕU
,, .$95$06$/d(5d(9(
A. Raspberry Pi
0RGOHU ELU \DSÕ\D VDKLS RODQ EX FLKD]ODU WDúÕQDELOLU
SURJUDPODQDELOHQ YH \|QHWLOHELOHQ ELOJLVD\DUODU RODUDN
DGODQGÕUÕOPDNWDGÕU /LQX[ LúOHWLP VLVWHPL LOH oDOÕúWÕUÕODQ EX
FLKD]ODU DPDFÕQD J|UH PRGOHU ELU \DSÕGD WDVDUODQDUDN
JHOLúWLULOHELOPHNWHGLU 6DGH DUD\]OHUL YH JoO LúOHPFLOHUL LOH
D÷ WUDIL÷LQLQ DOJÕODQPDVÕ YHULOHULQ WRSODQPDVÕ YH KHVDSODPD
LúOHPOHULLOH\RUXPODQPDVÕQGDWHUFLKHGLOLUKDOHJHOPLúWLU>@
ùHNLO5DVSEHUU\3LYJHQHOJ|UQP
B. Snort
6QRUW VDOGÕUÕ WHVSLW YH HQJHOOHPH VLVWHPL RODUDN NXOODQÕODQ
DoÕN ND\QDN NRGOX ELU \D]ÕOÕPGÕU øP]D WDEDQOÕ RODUDN oDOÕúDQ
EX VLVWHP D÷ ]HULQGH SURWRNRO YH DQRPDOL DQDOL]L \DSDELOPH
\HWHQH÷LQHGHVDKLSWLU(VQHNELUNXUDOGLOLQHVDKLSRODQVQRUW
NXOODQÕFÕODUÕQ NHQGL NXUDOODUÕQÕ \D]PDVÕQD RODQDN
VD÷ODPDNWDGÕU $\UÕFD FUHWVL] YH DoÕN ND\QDN NRGOX ROPDVÕ
\D\JÕQELUúHNLOGHDUDúWÕUPDDPDoOÕNXOODQÕOPDNWDGÕU>@
676,QWUXVLRQ'HWHFWLRQ6\VWHP,'6VDOGÕUÕWHVSLWVLVWHPL
RODUDN DGODQGÕUÕODQ EX VLVWHP D÷ ]HULQGHNL YHUL WUDIL÷LQLQ
LQFHOHQPHVL YH VDOGÕUÕQÕQ WHVSLW HGLOPHVL \|QWHPL RODUDN
ELOLQPHNWHGLU øON  \ÕOÕQGD RUWD\D DWÕODQ VDOGÕUÕ WHVSLW
VLVWHPL >@ JHQHO RODUDN ,3¶OHULQ ROXúWXUGX÷X WUDIL÷L L]OHU YH
SRUW DQDOL]L \DSDUDN ]DUDUOÕ \D]ÕOÕPODUÕQ ELU OLVWHVLQL ROXúWXUXU
$÷ \|QHWLFLVL EX ELOJLOHUL GH÷HUOHQGLUHUHN VDOGÕUÕ |QOHPH
VLVWHPOHULQLGHYUH\HDODELOLU
*HOHQHNVHO |]HOOLNOHUH VDKLS ELU JYHQOLN GXYDUÕ ZHE
VXQXFXODU ]HULQGH VDOGÕUÕ WHVSLW YH |QOHPH LúOHPOHULQL \HULQH
JHWLUHPH]YHoR÷XNH]ZHEVXQXFXVXQDHULúHQNXOODQÕFÕQÕQL\L
\DGDN|WQL\HWOLROGX÷XQXEHOLUOH\HPH]%XDúDPDGDLVH,'6
YH,36PRGOOHULGHYUH\HJLUHUHNEXJ|UHYLVWOHQLUOHU
676 GÕú ND\QDNODUGDQ JHOHQ VDOGÕUÕODUD NDUúÕ ELOJLVD\DU
D÷ÕQGD PH\GDQD JHOHQ ROD\ODUÕ RWRPDWLN RODUDN DQDOL] HGHQ
\D]ÕOÕP YH\D GRQDQÕPVDO VLVWHPOHUGLU >@,'6 D\QÕ ]DPDQGD
VDOGÕUÕ \DSÕOGÕ÷ÕQGD ILUHZDOO YH\D URXWHU JLEL LOHWLúLP D÷Õ
FLKD]ODUÕQÕ \HQLGHQ NRQILJUH HGHUHN WHNUDU D\QÕ \ROOD VDOGÕUÕ
\DSÕOPDVÕQÕHQJHOOHU ,'6¶LQVHQV|UYH\|QHWLPNRQVROXROPDN
]HUH LNL WHPHO ELOHúHQL YDUGÕU 6DOGÕUÕ WHVSLW VUHFL >@¶GD
ELOJLWRSODPDDQDOL]HWPHYHFHYDSG|QGUPHRODUDNoEDúOÕN
DOWÕQGD LQFHOHQPLúWLU >@ $úD÷ÕGDNL úHNLOGH |UQHN RODUDN ELU
VDOGÕUÕWHVSLWVLVWHPLJ|UOPHNWHGLU>@
ùHNLO6DOGÕUÕ7HVSLW6LVWHPLPLPDULVL>@
,,, 676¶1,17$6$5,0,
6DOGÕUÕ WHVSLW VLVWHPL JHQHO RODUDN o IDUNOÕ PHWRWWD >@
LúOHPJ|UU
ƒ $QRUPDOOLN WHVSLWL VWDQGDUW GDYUDQÕúD D\NÕUÕ RODQ
NDOÕSODUÕWHVSLWHGHU
ƒ .|W\H NXOODQÕP WHVSLWL ND\GHGLOHQ VDOGÕUÕ
PRGHOOHUL\OH NXOODQÕFÕ IDDOL\HWOHULQL WDQÕPODU YH
NDUúÕODúWÕUÕU
ƒ +LEULW PRG DOJÕODPD DQRUPDOOL÷LQ YH \DQOÕú
NXOODQÕP DOJÕODPDQÕQ ELU NRPELQDV\RQX EX
\|QWHP\DQOÕúSR]LWLIYH\D\DQOÕúQHJDWLIUHWPH\L
|QHPOL|OoGHD]DOWÕU
dDOÕúPDGD 5DVSEHUU\ 3L Y ELOJLVD\DUÕQ QHWZRUN PRGO
LOH WDVDUÕPÕQÕQ DUGÕQGDQ /LQX[ oHNLUGH÷L ]HULQH VQRUW ,'6
PRGOQQ NXUXOXPX \DSÕOPÕúWÕU 7DVDUODQDQ VLVWHPLQ
PLPDULVLúHNLO¶GHJ|VWHULOPH\HoDOÕúÕOPÕúWÕU

8%0.¶QG,QWHUQDWLRQDO&RQIHUHQFHRQ&RPSXWHU6FLHQFHDQG(QJLQHHULQJ 

 ùHNLO7DVDUODQDQVLVWHPPLPDULVL

A. Sistem Mimarisinin Oluúturulmas

øON DGÕPGD 5DVSEHUU\ 3L Y FLKD]Õ ]HULQH 6QRUW 676¶QLQ
NXUXOXPX \DSÕOPDOÕGÕU 6QRUW¶XQ NXUXOXPX LoLQ |QFHOLNOH
|QNRúXO SDNHWOHULQ (build-essential libpcap-dev libpcre3-dev
libdumbnet-dev zlib1g-dev) NXUXOXPX \DSÕOPÕúWÕU $UGÕQGDQ
VQRUWRUJ VLWHVLQGHQ ND\QDN NRG LQGLULOHUHN NXUXOXPD GHYDP
HGLOPLúWLU.D\QDNNRGLNLNÕVÕPGDQROXúPDNWDGÕUELULQFLVL
ùHNLO6QRUWNXUXOXPPLPDULVL
6QRUW¶XQ NXUXOXPX YH D\DUODUÕ WDPDPODQGÕNWDQ VRQUD
VD÷OÕNOÕ oDOÕúPDVÕ LoLQ WP JHUHNOL GRV\DODU úHNLO ¶GH
J|UOG÷JLELROPDOÕGÕU6QRUW¶XQDQDNRQILJUDV\RQGRV\DVÕ
'DWD$FTXLVLWLRQ/LEUDU\'$4 /etc/snort/snort.confúHNOLQGHGLU
sudo apt-get install bison -y
sudo apt-get install flex -y
sudo apt-get install libpcap-dev -y
sudo apt-get install libpcre3-dev -y
øNLQFLVLLVHVQRUW¶XQNHQGLNRGX D\DUODUÕ úHNLO ¶GD J|UOG÷ JLEL EXOXQXODQ D÷ \DSÕVÕQD J|UH
wget https://www.snort.org/downloads/snort/daq-2.0.6.tar.gz
wget https://www.snort.org/downloads/snort/snort-2.9.9.0.tar.gz
øNLQFL DGÕPGD ,'6 PRGOQQ NXUXOXPXQD JHoLOPLúWLU
ùHNLO ¶GH NXUXOXP WDPDPODQGÕNWDQ VRQUDNL HNUDQ J|UQWV
SD\ODúÕOPÕúWÕU
sudo dpkg -i daq_2.0.6-1_armhf.deb
sudo dpkg -i snort_2.9.9.0_armhf.deb
ùHNLO6QRUWNXUXOXPLúOHPLQLQWDPDPODQPDHNUDQÕ
6QRUW D\DUODUÕQÕ VDNOD\DQ NODV|UOHULQ YH NXOODQÕFÕ
ELOJLOHULQLQ \D]ÕODFD÷Õ GRV\DODUÕQ ROXúWXUXOPDVÕ DúD÷ÕGDNL
NRGODU\DUGÕPÕ\OD\DSÕOPDOÕGÕU
sudo mkdir -p /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/iplists/black_list.rules
7UDILNDQDOL]LYHPRQLWRULQJ\DSÕOPDVÕVÕUDVÕQGDORJODULoLQ
NODV|U sudo mkdir /var/log/snort NODV|U DNWLI HGLOPHOLGLU $\UÕFD
WP YHULOHULQ ND\GHGLOPHVL LoLQ mysql> create database snort;
NRPXWX\OD64/YHULWDEDQÕROXúWXUXOPDOÕGÕU
B. Oluúturulan Sistemin Çalútrlmas
6LVWHPLQ oDOÕúWÕUÕOPDVÕ VÕUDVÕQGD VHQDU\R RODUDN 
D÷ÕQGD EXOXQDQ NXOODQÕFÕODUGDQ JHOHQ ,3 SDNHWOHUL PRQLW|U
HGLOPH\H oDOÕúÕOPÕúWÕU %XQXQ LoLQ LON RODUDN FRQI GRV\DVÕQÕQ
\HQLGHQG]HQOHQPHOLGLU
ùHNLO&RQIGRV\DVÕQÕQVHQDU\R\DJ|UHG]HQOHQPHVL
,9 %8/*8/$5
3ODQODQDQ VHQDU\R\D J|UH D\DUODPDODU \DSÕOGÕNWDQ VRQUD
676 oDOÕúWÕUÕOPDOÕGÕU =DUDUOÕ WUDIL÷LQ WHVSLWL LoLQ NXOODQÕODFDN
NXUDOODU GRV\DVÕQD EDNÕOGÕ÷ÕQGD GRV\DQÕQ ERú ROGX÷X
J|UOPHNWHGLU /etc/snort/rules/local.rules GRV\DVÕQÕ DoÕS DúD÷ÕGDNL
JLEL|UQHNNXUDOODU\D]ÕODELOLU
A. A÷ øzleme øçin Kural Tanmlama
%X X\JXODPDGD ELULQFL NXUDO LOH KHUKDQJL ELU KRVW¶XQ
EHOLUOHGL÷LPL]D÷DSLQJDWWÕ÷ÕQGDX\DUÕYHUPHVLQLGL÷HUNXUDOGD
LVHIDUNOÕoHúLWOHUGHSRUWWDUDPDVÕJHUoHNOHúWLULSX\DUÕYHULOPHVL
VD÷ODQPÕúWÕU
.XUDO alert icmp any any Æ $HOME_NET any (msg:"ICMP test
detected"; GID:1; sid:10000001; rev:001; classtype:icmp-event;)
.XUDO alert tcp any any Æ any any (msg:"FIN Scan"; flags: F; sid:
1000002;)
alert tcp any any Æ any any (msg:"NULL Scan"; flags: 0;sid:1000003;)
alert tcp any any Æ any any (msg:"SYN attack"; flags:S,12;sid:1000004;)
B. Kurallarn Testi
%LULQFL NXUDO YH LNLQFL NXUDOÕQ WHVW HGLOPHVL VÕUDVÕQGD D÷
]HULQGHQED]ÕWUDILNYHULOHUL HOGHHGLOPLúWLU.XUDO¶D J|UHD÷
]HULQGHoDOÕúDQELUFLKD]ÕQ DGUHVLQGHQúHNLO¶GH

8%0.¶QG,QWHUQDWLRQDO&RQIHUHQFHRQ&RPSXWHU6FLHQFHDQG(QJLQHHULQJ 

J|UOG÷ JLEL EWQ NHQDU VZLWFK¶OHUH SLQJ DWWÕ÷Õ
EHOLUOHQPLúWLU
ùHNLO$÷]HULQGHSLQJX\DUÕOLVWHVL
øNLQFL NXUDOD J|UH LVH úHNLO ¶GH J|UOHQ 7&3 ED÷ODQWÕVÕ
\DSÕOGÕ÷ÕQGDX\DUÕODUÕQELUOLVWHVLDOÕQPÕúWÕU
|QJ|UV oÕNDUÕODELOLU $÷ ]HULQGH EXOXQDQ NXOODQÕFÕODUÕQ
L]OHULQH J|UH oHúLWOL X\DUÕODU YH HQJHOOHPHOHU \DSÕODUDN D÷ÕQ
JYHQOL÷LYHSHUIRUPDQVÕQÕQDUWÕUÕOPDVÕVD÷ODQDELOLU
<D]DU1RWX %XoDOÕúPD+LWLWhQLYHUVLWHVL%$3%LULPLWDUDIÕQGDQ
GHVWHNOHQHQ08+ QXPDUDOÕSURMHGHQWUHWLOPLúWLU
.$<1$.d$
>@ 1DEL = $  )LUHZDOO IRU WKH 'HYHORSLQJ :RUOG DU;LY
KWWSVDU[LYRUJDEV0D\
>@ ùHQ 6&ODUN-$0RELO7DVDUVÕ]$÷ODUGD6DOGÕUÕ 7HVSLWL$÷ YH%LOJL
*XYHQOLJL8OXVDO6HPSR]\XPX
>@ $EUDKDP$*URVDQ&(YROYLQJLQWUXVLRQGHWHFWLRQV\VWHPV*HQHWLF
6\VWHPV3URJUDPPLQJ7KHRU\DQG([SHULHQFHV
>@ 6XQ % :X . 3RRFK 8: =RQHEDVHG LQWUXVLRQ GHWHFWLRQ IRU
PRELOH DG KRF QHWZRUNV ,QW -RXUQDO RI $G +RF DQG 6HQVRU :LUHOHVV
1HWZRUNV
>@ +XDQJ < )DQ : /HH : <X 36 &URVVIHDWXUH DQDO\VLV IRU
GHWHFWLRQ DGKRF URXWLQJ DQRPDOLHV ,QW &RQI 2Q 'LVWULEXWHG
&RPSXWLQK6\VWHPV,&'&6
>@ )HUGRXVK 6 /L ; :LUHOHVV 6HQVRU 1HWZRUN 6\VWHP 'HVLJQ XVLQJ
ùHNLO$÷]HULQGH7&3ED÷ODQWÕX\DUÕOLVWHVL 5DVSEHUU\ 3L DQG $UGXLQR IRU (QYLURQPHQWDO0RQLWRULQJ $SSOLFDWLRQV
7KH WK ,QWHUQDWLRQDO &RQIHUHQFH RQ )XWXUH 1HWZRUNV DQG
$UGÕQGDQSRUWED]OÕELUWDUDPDVDOGÕUÕVÕQÕQDOJÕODPDVÕ6<1 &RPPXQLFDWLRQV )1& 3URFHGLD &RPSXWHU 6FLHQFH  
18//),1VFDQ\DSÕOPÕúWÕU3RUWWDUDPDVÕVLVWHPOHUHKDFNLQJ ±
\DSÕOPDVÕQÕQ |Q DúDPDVÕ RODUDN ELOLQPHNWHGLU %X VDOGÕUÕ >@ 5ROELQ 0 (DUO\ GHWHFWLRQ RI QHWZRUN WKUHDWV XVLQJ 6RIWZDUH 'HILQHG
1HWZRUN 6'1 DQG YLUWXDOL]DWLRQ0DVWHU 7KHVLV &DUOHWRQ 8QLYHUVLW\
VÕUDVÕQGD DoÕN SRUWODUÕQ WHVSLW HGLOPHVL\OH VLVWHPH VDOGÕUÕ 2WWDZD&DQDGD
\DSÕODELOPHNWHGLU .XUDO¶ÕQ oDOÕúWÕUÕOPDVÕ LOH DúD÷ÕGDNL úHNLO
>@ .\DZ .$ &KHQ < -RVHSK - 3L,'6 (YDOXDWLRQ RI 2SHQ6RXUFH
¶GDOLVWHOHQHQGXUXPHOGHHGLOPLúWLU ,QWUXVLRQ 'HWHFWLRQ 6\VWHPV RQ 5DVSEHUU\ 3L   6HFRQG
,QWHUQDWLRQDO &RQIHUHQFH RQ ,QIRUPDWLRQ 6HFXULW\ DQG &\EHU )RUHQVLFV
,QIR6HF,6%1‹,(((
>@ +HQWVFKHO . -DFRE ' 6LQJHU - DQG &KDOPHUV 0 6XSHUVHQVRUV
ùHNLO3RUWED]OÕWUDILN X\DUÕ OLVWHVL
9 6218d/$5
%X oDOÕúPDGD D÷ WHPHOOL VDOGÕUÕ WHVSLW \|QWHPOHULQGHQ
EDKVHGLOPLúWLU dDOÕúPDQÕQ EXOJXODUÕQD J|UH GúN PDOL\HWOL
5DVSEHUU\ 3L FLKD]Õ LOH DoÕN ND\QDN NRGOX 6QRUW ,'6 PRGO
ELUOHúWLULOHUHN ,3 YH 3RUW ED]OÕ ELU WUDILN DQDOL]L \DSÕOPÕúWÕU
%|\OHFH62+2D÷ODUGDEX\|QWHPLQNXOODQÕODUDNWUDILNDQDOL]L
\DSÕODELOHFH÷LRUWD\DNRQPD\DoDOÕúÕOPÕúWÕU
8\JXODPD VÕUDVÕQGDEHOLUOHQHQ,3JUXEXQGDQ\DSÕODQSLQJ¶
OHU LoLQ ELU NXUDO YH SRUW DQDOL]L LoLQ GH LNLQFL ELU NXUDO
WDQÕPODQPÕúWÕU .XUDOODUÕQ oDOÕúWÕUÕOPDVÕ VRQXFXQGD JHOLúWLULOHQ
VLVWHP EDúDUÕOÕ ELU úHNLOGH QHWZRUN WUDILN L]OHPHVL \DSPÕúWÕU
(OGH HGLOHQ ORJ ND\ÕWODUÕQD J|UH VLVWHP \|QHWLFLVL VDOGÕUÕ ROXS
ROPDGÕ÷ÕQD \D GD WUDIL÷LQ N|W QL\HWOL ROXS ROPDGÕ÷ÕQD NDUDU
YHUHELOLU YH VDOGÕUÕ\Õ |QOHPH \ROXQD JLGHELOLU %X \|QWHP LOH
IDUNOÕ NXUDO WDEDQOÕ DQDOL]OHU \DSÕODUDN D÷ WUDIL÷LQLQ ELU
5DVSEHUU\ 3L 'HYLFHV IRU 6PDUW &DPSXV ,QIUDVWUXFWXUH VKRUW SDSHU
,((( WK ,QWHUQDWLRQDO &RQIHUHQFH RQ )XWXUH ,QWHUQHW RI 7KLQJV DQG
&ORXG
>@ .XWXNLDQ * 5DVSEHUU\ 3L +RPH 1HWZRUN 0RQLWRULQJ 7RRO 0DVWHU
7KHVLV &RPSXWHU 6FLHQFH LQ &DOLIRUQLD 6WDWH 3RO\WHFKQLF 8QLYHUVLW\
3RPRQD
>@ 7XQFHU 7 7DWDU < )SJD 7DEDQOÕ 3URJUDPODQDELOLU *|PO 6DOGÕUÕ
7HVSLW 6LVWHPLQLQ *HUoHNOHúWLULOPHVL -RXUQDO RI WKH )DFXOW\ RI
(QJLQHHULQJDQG$UFKLWHFWXUHRI*D]L8QLYHUVLW\9RO1R

>@ KWWSVZZZGLUHQFQHWUDVSEHUU\SL
"JFOLG &-2GS-THW4&)G.G*ZRGXZF0+J (ULúLP7DULKL+D]LUDQ

>@ %LOJHP 6QRUW¶D *HQHO %DNÕú KWWSVZZZELOJLJXYHQOLJLJRYWUVDOGLUL
WHVSLWVLVWHPOHULVQRUWNXUXOXPXKWPO(ULúLP7DULKL+D]LUDQ

>@ - &R &RPSXWHU 6HFXULW\ 7KUHDW 0RQLWRULQJ DQG 6XUYHLOODQFH
3HQQV\OYDQLD-DPHV3$QGHUVRQ&RPSDQ\)RUW:DVKLQJWRQ
>@ ; =KDQJ / -LD + 6KL = 7DQJ YH ; :DQJ 7KH $SSOLFDWLRQ RI
0DFKLQH/HDUQLQJ0HWKRGVWR,QWUXVLRQ'HWHFWLRQ
>@ .D\D d <ÕOGÕ] 2 0DNLQH g÷UHQPHVL 7HNQLNOHUL\OH 6DOGÕUÕ 7HVSLWL
.DUúÕODúWÕUPDOÕ $QDOL] 0DUPDUD )HQ %LOLPOHUL 'HUJLVL 
'2,PXIEHG
>@ 0DKDMDQ 6 $GDJDOH0 $ 6DKDUH & ,QWUXVLRQ 'HWHFWLRQ 6\VWHP
8VLQJ5DVSEHUU\3,+RQH\SRWLQ1HWZRUN6HFXULW\,QWHUQDWLRQDO-RXUQDO
RI (QJLQHHULQJ 6FLHQFH DQG &RPSXWLQJ 9ROXPH  1R '2,
0DUFK
>@ 9RNRURNRV / )DQIDUD 3 5DGXVRYVNê - DQG 3RyU 3 6RSKLVWLFDWHG
+RQH\SRW0HFKDQLVP± WKH$XWRQRPRXV+\EULG6ROXWLRQIRU(QKDQFLQJ
&RPSXWHU 6\VWHP ,((( WK ,QWHUQDWLRQDO 6\PSRVLXP RQ $SSOLHG
0DFKLQH ,QWHOOLJHQFH DQG ,QIRUPDWLFV -DQXDU\   )HEUXDU\  

8%0.¶QG,QWHUQDWLRQDO&RQIHUHQFHRQ&RPSXWHU6FLHQFHDQG(QJLQHHULQJ