Real-Time Threat Detection and Mitigation: Advancing Snort IDPS Capabilities

Facing the increasingly serious problem of cyber security, the project proposed a practical and efficient network defence model based on Snort and Wireshark. Previous studies emphasise the role of IDSes and packet inspection for recognizing real-time attacks. Rule-based detection tools such as Snort, and packet monitoring tools like Wireshark are frequently referred to in academic papers. The test environment includes three VMs: attacker, victim, and monitor to emulate practical scenarios. The attack classes that have been tested include DoS attacks, brute-force login attempts, SQL injection, XSS, and command injections. Snort detection rules, which were hand-crafted, to produce actual time alarms. Wireshark saw use as a sanity check for Snort alerts and deeper packet dissection. A script automation was integrated in Snort for instantly dropping malicious IPs. Dynamic firewall rules were used to counter ongoing attacks applications. The detection-response duality eventually brought about swift containment. This resulted in an identification of all simulated attacks within the virtual lab. It provided monitoring and active defence capabilities by open-source software, and was effective. Results validate the reliability, scalability, and versatility of the approach. The low availability makes it is convenient to be an appropriate and economical choice for both cybersecurity education and research.