Sentinel Guard: An Hybrid Firewall for USB and Network Intrusion Detection

Abstract

The rapid increase in cyber threats against removable storage devices and network infrastructures has highlighted the limitations of traditional security solutions, including rule-based firewalls and signature-based antivirus software. Today, cyber attacks often use usb devices as vectors for malicious attacks and network-based attacks, including port scanning and flooding attacks. To address these issues, this paper proposes a new intrusion detection and prevention framework called sentinelguard, which is based on a hybrid approach combining endpoint security and network security under a software-defined model. The proposed system integrates machine learning-based usb malware detection and real-time network intrusion detection to detect and mitigate security threats. The detection of malicious files in the usb device is done using the gaussian naïve bayes classifier, trained using the clamp dataset, which can detect malicious executable files in the usb device. For real-time intrusion detection, the system can inspect tcp packets using the scapy library and analyze the source ip, destination port, and tcp flags to detect malicious activities such as port scanning and syn flood attacks. Once the malicious activities are detected, the system can enforce prevention policies by blocking the attacker’s ip addresses using firewall commands in the operating system. All the malicious activities detected by the system are stored in a mysql database, and the real-time visualization is done using a web-based interface built using the flask framework. The experimental validation proves that the proposed sentinelguard is able to detect and prevent both usb-based and network-based attacks while providing central monitoring and automated response mechanisms. The proposed framework provides a scalable and lightweight cybersecurity solution that can be used in research and enterprise networks.