The week's pick
Reseach Article
Comparative Analysis of the Performance of Network Intrusion Detection Systems: Snort, Suricata and Bro Intrusion Detection Systems in Perspective
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 176 - Number 40 |
| Year of Publication: 2020 |
| Authors: Godwin Kudjo Bada, Williams Kwame Nabare, Daniel Kwame Kwansah Quansah |
10.5120/ijca2020920513
|
Godwin Kudjo Bada, Williams Kwame Nabare, Daniel Kwame Kwansah Quansah . Comparative Analysis of the Performance of Network Intrusion Detection Systems: Snort, Suricata and Bro Intrusion Detection Systems in Perspective. International Journal of Computer Applications. 176, 40 ( Jul 2020), 39-44. DOI=10.5120/ijca2020920513
Abstract
There exists a number of intrusion detection systems particularly those that are open-source. These intrusion detection systems have their strengths and weaknesses when it comes to intrusion detection. This work compared the performance of open-source intrusion detection systems namely Snort, Suricata and Bro. The comparative analysis of these intrusion detection systems was carried out to present an independent view of their performance regarding intrusion detection. It took into consideration their effectiveness in detecting Denial of Service, probe, scan, User-to-Local and User-to-Root attacks and also detection accuracy in terms of false positive, false negative and true positive alarms. All three IDS were installed on virtual machines with the same specification with a network switch linking them to a target server in a virtual environment using maximum Ethernet speed of 5Gigabits per second (Gbps). False positive, false negative and true positive alarm rates of Snort, Suricata and Bro IDSs have also been determined in this work through the injection of normal and malicious attacks such as DoS, probe, scan and user-to-root. Transmission Control Protocol, User Datagram Protocol and Internet Control Message Protocol were the normal traffic used.
References
- Amira, S.A., Salama, M., Hassanien, A.E., Hanafi, S.E. & Tolba, M.F. (2013). "Multi-layer hybrid machine learning techniques for anomalies detection and classification approach". In. 13th International Conference on Hybrid Intelligent Systems (HIS) (pp. 215-220). IEEE.
- Bro-ids (2008). Bro-ids Technical Report. California: International Computer Science Institute.
- Bro-ids (2014). http://www.bro.org. Retrieved 8 22, 2017, from bro.org: http://www.bro.org
- Gerber, J. (2010, 08 26). http://blog.securitymonks.com. Retrieved 12 14, 2017, from securitymonks.com: http://www.securitymonks.com
- Johnson, K. (2008). Basic Analysis and Security Engine, Tech. Report.
- Mehra, P. (2012). A brief study and comparison of Snort and Bro Open Source Network Intrusion Detection System. International Journal of Advanced Research in Computer and Communication Engineering, 1 (6), 384-389.
- Moore, G. (1965). Cramming more components onto integrated circuits. IEEE, 11 (3), 114-117.
- Nielsen, J. (2010, 08 18). http://www.nngroup.com/articles/law-of-bandwidth. Retrieved 08 18, 2011, from http://www.nngroup.com
- Open Information Security Foundation (OISF). (2011, 04 05). www.openinfosecfoundation.org. Retrieved 12 10, 2017, from OISF Foundation web site: http://www.openinfosecfoundation
- Paxson, V. (1999). "Bro: a system for detecting network intruders in real-time,". Journal of Computer Networks, 31, 2435-2463.
- Ross, S. (2007). IS Security Matters. Information Systems Control Journal, 6, 14-19.
- Sourour, M., Adel, B. & Tarek, A. . (2009). Environmental awareness intrusion detection and prevention system toward reducing false positives and false negatives. In Proceedings of IEEE Symposium on Computational Intelligence in Cyber Security (CICS '09) (pp. 107 –114). Oslo: IEEE.
Index Terms
Keywords