Abstract
Several studies have been conducted where authors compared the performance of open source Intrusion detection systems, namely Snort and Suricata. However, these studies were mostly limited to either security indicators or performance measurements under the same operating system. The objective of this study is to provide a comprehensive analysis of both products in terms of several security and performance related indicators under two different operating systems. Experiments were conducted to evaluate the effects of open source intrusion detection and prevention systems; Snort and Suricata running on Windows and Linux operating system. Attack types on system such as resource usage, dropped packets rate and ability to detect intrusions serve as experiment benchmarks. From the result, Snort is shown to work better in Linux platform in terms of intrusion detection compared to Suricata. In terms of performance in windows platforms, Snort demonstrated lesser intrusion detection than its Linux-based execution. This is different with Suricata, with its Linux configuration shown to be unable to detect any attack executed. The results also indicated that Linux-based execution consumes more system resources than its windows-based counterpart.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Albin, E.: A comparative analysis of the Snort and Suricata intrusion-detection systems. Naval Postgraduate School, Monterey CA (2011)
Chakrabarti, S., Chakraborty, M., Mukhopadhyay, I.: Study of Snort-based IDS. In: Proceedings of the International Conference and Workshop on Emerging Trends in Technology, pp. 43–47. ACM (2010)
Saboor, A., Akhlaq, M., Aslam, B.: Experimental evaluation of Snort against DDoS attacks under different hardware configurations. In: 2013 2nd National Conference on Information Assurance (NCIA), pp. 31–37. IEEE (2013)
Day, D., Burns, B.: A performance analysis of Snort and Suricata network intrusion detection and prevention engines. In Fifth International Conference on Digital Society, Gosier, Guadeloupe, pp. 187–192 (2011)
Alhomoud, A., Munir, R., Disso, J.P., Awan, I., Al-Dhelaan, A.: Performance evaluation study of intrusion detection systems. Procedia Comput. Sci. 5, 173–180 (2011)
Kacha, C., Shevade, K.A.: Comparison of different intrusion detection and prevention systems. Int. J. Emerg. Technol. Adv. Eng. 2(12), 243–245 (2012)
Albin, E., Rowe, N.C.: A realistic experimental comparison of the Suricata and Snort intrusion-detection systems. In: 2012 26th International Conference on Advanced Information Networking and Applications Workshops (WAINA), pp. 122–127. IEEE (2012)
White, J.S., Fitzsimmons, T., Matthews, J.N.: Quantitative analysis of intrusion detection systems: Snort and Suricata. SPIE Defense, Security, and Sensing, pp. 875704–875704 (2013)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Isa, F.M., Saad, S., Fadzil, A.F.A., Saidi, R.M. (2019). Comprehensive Performance Assessment on Open Source Intrusion Detection System. In: Kor, LK., Ahmad, AR., Idrus, Z., Mansor, K. (eds) Proceedings of the Third International Conference on Computing, Mathematics and Statistics (iCMS2017). Springer, Singapore. https://doi.org/10.1007/978-981-13-7279-7_6
Download citation
DOI: https://doi.org/10.1007/978-981-13-7279-7_6
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-13-7278-0
Online ISBN: 978-981-13-7279-7
eBook Packages: Computer ScienceComputer Science (R0)