Performance analysis of two open source intrusion detection systems
Authors:
- 1 May 2016
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 1387-1392
Abstract
Several studies have been conducted where authors compared the performance of open source Intrusion detection systems, namely Snort and Suricata. However, most studies were limited to either security indicators or performance measurements under the same operating system. The objective of this study is to give a comprehensive analysis of both products in terms of several security related and performance related indicators. In addition, we tested the products under two different operating systems. Several experiments were run to evaluate the effects of open source intrusion detection and prevention systems Snort and Suricata, operating systems Windows, Linux and various attack types on system resource usage, dropped packets rate and ability to detect intrusions. The results show that Suricata has a higher CPU and RAM utilization than Snort in all cases on both operating systems, but lower percentage of dropped packets when evaluated during five of six simulated attacks. Both products had the same number of correctly identified intrusions. The results show that Linux-based solutions consume more system resources, but Windows-based systems had a higher rate of dropped packets. This indicates that these two intrusion detection and prevention systems should be run on Linux. However, both systems are inappropriate for high volumes of traffic in single-server setting.Keywords
This publication has 13 references indexed in Scilit:
- Signature Based Intrusion Detection for Zero-Day Attacks: (Not) A Closed Chapter?2014
- Experimental evaluation of Snort against DDoS attacks under different hardware configurations2013
- Evaluation studies of three intrusion detection systems under various attacks and rule sets2013
- Quantitative analysis of intrusion detection systems: Snort and Suricata2013
- A Realistic Experimental Comparison of the Suricata and Snort Intrusion-Detection Systems2012
- Performance Evaluation Study of Intrusion Detection SystemsProcedia Computer Science, 2011
- Performance evaluation comparison of Snort NIDS under Linux and Windows ServerJournal of Network and Computer Applications, 2010
- Evaluating Intrusion Detection Systems in High Speed Networks2009
- The Problem of False Alarms: Evaluation with Snort and DARPA 1999 Dataset2008
- Investigating the problem of IDS false alarms: An experimental study using Snort2008