COMPARISON OF SOFTWARE AND HARDWARE BASED INTRUSION PREVENTION SYSTEMS

Abstract

In this study, attacks in three different scenarios were organized by Nmap and Hping3 tools on the virtual Kali server to physical servers running two software-based, open source Intrusion Prevention Systems (IPS-A and IPS-B) and one hardware-based, closed-source Intrusion Prevention System (IPS-C). Although the software-based IPS-A has high packet capture performances, it has been observed that the detection/alarm results are below the average. Although the hardware-based IPS-C is an optimized appliance to put a minimum load on the processor, the detection/alarm figures are at very low levels. In this paper, it has been observed that the IPS-B which is the other software-based Intrusion Prevention System, has a processor usage of 100% but it has reached a far ahead result with very high analysis and detection/alarm performance. In this study, in all the scenarios, four different packet numbers and about twenty parameters were applied to all three IPSs that packet capture performance is quite high and 100%. All three IPSs achieved 100% detection results in attacks where a small number of packets were sent.