A Comparative Experimental Design and Performance Analysis of Snort-Based Intrusion Detection System in Practical Computer Networks

Abstract

Abstract:As one of the most reliable technologies, network intrusion detection system (NIDS) allows the monitoring of incoming and outgoing traffic to identify unauthorised usage and mishandling of attackers in computer network systems. To this extent, this paper investigates the experimental performance of Snort-based NIDS (S-NIDS) in a practical network with the latest technology in various network scenarios including high data speed and/or heavy traffic and/or large packet size. An effective testbed is designed based on Snort using different muti-core processors, e.g., i5 and i7, with different operating systems, e.g., Windows 7, Windows Server and Linux. Furthermore, considering an enterprise network consisting of multiple virtual local area networks (VLANs), a centralised parallel S-NIDS (CPS-NIDS) is proposed with the support of a centralised database server to deal with high data speed and heavy traffic. Experimental evaluation is carried out for each network configuration to evaluate the performance of the S-NIDS in different network scenarios as well as validating the effectiveness of the proposed CPS-NIDS. In particular, by analysing packet analysis efficiency, an improved performance of up to 10% is shown to be achieved with Linux over other operating systems, while up to 8% of improved performance can be achieved with i7 over i5 processors.

On the Optimality of Virtualized Security Function Placement in Multi-Tenant Data Centers

“…Snort captures and inspects packets to detect malicious activities through DPI on the packet payload against attacks signatures represented as a rule set. While many traffic features affect resource consumption such as, e.g., traffic load, traffic type, packet size, present or absence of attack, number of packet fragmentation [17]- [19] , yet traffic intensity is the main factor to consider for initial deployment. Thus, each security module in the pool will be associated with two resource vectors that represent a baseline requirement (resources required for initial deployment of the module) and a traffic requirement associated with each traffic type (e.g.…”

A Filter Feature Selection Algorithm Based on Mutual Information for Intrusion Detection

“…Along with network the development and application, serious security threats have emerged. Intrusion detection based on networks is an important step of cyber security [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15]. By analyzing large amounts of network data, network-based intrusion detection can effectively mitigate security threats [16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34][35].…”

“…Features selected by different feature selection algorithms using the denial of service (DOS) classifier. ,4,19,15,16,18,17,31,14,28,23,20,26,11,27,40,3,29,1,42,13,32,38,30,39,5,41 MIFS (β = 0.7 )[19] 317, 2, 19, 15, 16, 18, 17, 14, 23, 20, 31, 26, 28, 11, 27, 40, 29, 3, 1, 42, 39, 30, 4, 5, 32, 13, 41, 36, 38, 35, 34 , 13, 4, 19, 15, 16, 17, 18, 14, 28, 20, 23, 31, 29, 11, 26, 27, 40, 42, 3, 38, 1 …”

Toward Bulk Synchronous Parallel-Based Machine Learning Techniques for Anomaly Detection in High-Speed Big Data Networks

“…Similarly, the studies in [27][28][29][30][31] also addressed the notion of intrusion detection in large-scale networks and paved the path forward by devising various strategies and architectures. In [27], the authors proposed centralized parallel Snort-based NIDSs to deal with the issues of high speed networks using various multicore processors and operating systems.…”

“…In [27], the authors proposed centralized parallel Snort-based NIDSs to deal with the issues of high speed networks using various multicore processors and operating systems. The system attempts to enhance the performance in terms of reducing packet drop ratio, and it also helps the network security management to keep track of all attack behaviors to develop and enhance security policies.…”