Development of an OSSEC-powered host-based intrusion detection system

Current approach of host-based intrusion detection is often cumbersome because it is mainly executed via the command line and comes with a level of complication. Thus, this study attempts to develop the solution that will allow for effective, continuous host-based security monitoring through OSSEC, which is an open-source intrusion detection engine coupled with custom web interface. In the study, an Agile development approach employed. The back-end of the project was built with FastAPI framework and Python. While SQLite database was used for storing collected logs, and the Nginx is implemented as a web server. For the front-end of the system, HTML, CSS, and JavaScript was used to design the interface for alert visualization. OSSEC works as a host-based IDS solution by analysing system logs, file integrity checks, and policy violations. With the help of a purpose-designed web interface, the information is delivered to the administrator who can use it to react promptly to potential threats to the server. Hence, making intrusion detection system more usable.