Open Source Intrusion Detection Research Articles

Analysis of open-source intrusion detection and prevention systems for integration with Russian operating systems

The article reviewed IDS/IPS such as Snort, Suricata, Fail2Ban and OSSEC, which have opensource code. Their mechanisms for ensuring network security, including architecture, functions, tools and implemented tasks, are analyzed. The possibility of integrating these systems with Russian operating systems is considered. In conclusion, it is emphasized that IDS/IPS are just one of the many layers of protection that must be implemented to ensure effective security. Only an integrated approach to security can be the key to protecting against modern cyber threats.

Which open-source IDS? Snort, Suricata or Zeek

Driven by the high and diverse network traffic and increase in the number of active attackers, nearly every organization including government institutions and enterprises are forced to deploy Network Intrusion Detection and Prevention Systems (NIDPS). It becomes a challenging task for NIDPS to process high-speed traffic that results in packet drops and consequently leads to degraded system performance. Thus, necessitating the requirement to assess the NIDPS performance in terms of various parameters such as resource consumption, packet processing, packet drop rate, throughput, and latency. In this study, we scrutinized three Open-Source Intrusion Detection and Prevention Systems (IDPS) Snort (both variants: single-threaded and multi-threaded), Suricata, and Zeek; while, using similar performance parameters normally used to evaluate commercial IDPS solutions. Such a comprehensive performance review has not been considered in the prior works. We considered typical NIDPS deployment in Small and Medium-sized Enterprises (SMEs) and conducted system assessment by using variations of various factors such as packet capturing modules, detection engine algorithms, packet size, and ruleset size. Such a thorough analysis is expected to be of great value for both the practitioners and the researchers in the selection and further enhancement of optimum IDPS configuration as per their requirements.

CCgen: Injecting Covert Channels into Network Traffic

Covert channels are methods to convey information clandestinely by exploiting the inherent capabilities of common communication protocols. They can be used to hide malware communication as part of cyber attacks. Here, we present CCgen, a framework for injecting covert channels into network traffic that includes modules for common covert channels at the network and transport layer and allows a smooth integration of novel covert channel techniques. Our tool—openly available and implemented in Python—enables the operation on-the-fly in live communications as well as the manipulation of network traffic packet captures. We evaluate a first prototype by generating a varied assortment of covert channels based on state-of-the-art techniques and check their detectability with Suricata, a popular, open-source intrusion prevention and detection system. The injected covert channels remain mostly undetected. Our proposal fills a gap within the diversity of openly available tools for cybersecurity research and education. It builds a flexible environment for experts to test analysis algorithms, thus also enabling advanced training in applied network steganography.

Experimental based comparative study on open-source network intrusion detection system

Experimental based comparative study on open-source network intrusion detection system

Importance of Machine Learning Techniques to Improve the Open Source Intrusion Detection Systems

Nowadays, it became difficult to ensure data security because of the rapid development of information technology according to the Vs of Big Data. To secure a network against malicious activities and to ensure data protection, an intrusion detection system played a very important role. The main objective was to obtain a high-performance solution capable of detecting different types of attacks around the system. The main aim of this paper is to study the lacks of traditional and open source Intrusion Detection Systems and the Machine Learning techniques commonly used to overcome these lacks. A comparison of some existing works by Intrusion Detection System type, detection method, algorithm and accuracy was provided.

Docker Swarm and Kubernetes Containers for Smart Home Gateway

The Internet of Things (IoT) for warehouse automation in new generation industries and home gateway in smart homes have very tight latency requirements for data computation and response. To satisfy the requirements, many studies have moved the computation close to IoT devices by virtualizing the services using containers and deploying them on IoT gateways. They do not account for limited resources at IoT gateways, and without careful provisioning, IoT gateways can easily become overloaded and inevitably increase the computation time. To enable efficient service provisioning on IoT gateways, this article presents the empirical evaluation of docker swarm and Kubernetes (K8s) container solutions, on resource constrained devices such as Raspberry Pi boards. We have used multiple open source intrusion detection systems and deep learning based data analytic solutions in our experiments to evaluate creation time, CPU utilization, and memory usage. Our results reveal that creation time and memory usage of containers are critical factors in constrained environments. The lessons learned from our empirical case studies provide essential guidelines for micro-services architectures in IoT gateways.

Opportunities and prospects of using Open-Source intrusion detection technologies in the spheres of small and medium business of Ukraine

The use of intrusion detection methods, such as IDS and Honeypot, to protect the network infrastructures of small and medium-sized businesses in Ukraine is considered.

LSH-XGBoost based Network Congestion Detection Method for SSDN

Signal Safety Data Network (SSDN) is essential to maintain the reliable transmission between station and station equipment, station and central signal equipment. Threats in SSDN include but not limited to poor performance in tele-communication and denial of service when network congestion occurs. Therefore, it’s of great significance detecting the potential network congestion in railroad SSDN. Existing detection algorithms are low efficient, less accurate and are unable to cover all the detection categories. By combining the advantages of low time complexity and high classification accuracy originate from Local Sensitive Hashing (LSH) and eXtreme Gradient Boosting (XGBoost), we introduce a network congestion detection method based on LSH-XGBoost for SSDN. We run testing on open source intrusion detection system: Snort, which was built on SSDN simulator. The promising result proved its capability.

Detecting attacks in high-speed networks: Issues and solutions

ABSTRACTIntrusion detection systems are one of the necessities of networks to identify the problem of network attacks. Organizations striving to protect their data from intruders are often challenged by attackers, who find new ways to attack and compromise the security of the network. The detection process becomes quite difficult while dealing with high-speed and distributed attacks that are performed using botnets. These attacks threat both the confidentiality of legitimate users and the infrastructure of the network and to protect them, early discovery of network attacks is important. In this paper, an open source Intrusion Detection System (IDS), Snort is presented as a solution to detect DoS and Port Scan network attacks in a high-speed network. A set of custom rules has been proposed for Snort to detect DoS and Port Scan attacks in high-speed network. The rules are compared and tested using different attack generators like Scapy, Hping3, LOIC and Nmap. Snort’s efficiency in detecting the DoS and Port Scan attacks using the new rules is experimentally proved to be around 99% for all the attacks except for Ping of Death. The proposed system works well for different attack generators in a high-speed network.

Analysing performance issues of open-source intrusion detection systems in high-speed networks

Driven by the growing data transfer needs, industry and research institutions are deploying 100 Gb/s networks. As such high-speed networks become prevalent, these also introduce significant technical challenges. In particular, an Intrusion Detection System (IDS) cannot process network activities at such a high rate when monitoring large and diverse traffic volumes, thus resulting in packet drops. Unfortunately, the high packet drop rate has a significant impact on detection accuracy. In this work, we investigate two popular open-source IDSs: Snort and Suricata along with their comparative performance benchmarks to better understand drop rates and detection accuracy in 100 Gb/s networks. More specifically, we study vital factors (including system resource usage, packet processing speed, packet drop rate, and detection accuracy) that limit the applicability of IDSs to high-speed networks. Furthermore, we provide a comprehensive analysis to show the performance impact on IDSs by using different configurations, traffic volumes and different flows. Finally, we identify challenges of using open-source IDSs in high-speed networks and provide suggestions to help network administrators to address identified issues and give some recommendations for developing new IDSs that can be used for high-speed networks.

Improving Intrusion Detection and Prevention System (IDPS) Performance in an IPv6 Environment

This paper presents a comprehensive investigation, backed up by detailed simulations, that the default settings of the software based open source Intrusion Detection and Prevention Systems (IDPs) are not enough to thwart the network attacks in a modern high-speed IPv6-only environment. It aims to solve this problem by improving the processing capabilities of an IDPS in more than one way, with each method being totally independent from the other. The proposed solution can be implemented by any user running an IDPS, without needing escalated privileges. Using and IPv6 packet generator, it is shown that with the increase in IPv6 traffic in a fixed amount of time, the IDPS fails to analyse all the packets and starts dropping them. This phenomenon compromises the core functionality of IDPS which is to stop the unwanted traffic. A hybrid solution has been proposed to increase the performance of the IDPS. Our research involves only the system running an IDPS, with little to no tweaking of the other elements within a network like routers, switches and firewalls. The paper also talks briefly about the current and the future generation of the IDPSs. The simulation with the hybrid solution concludes that the performance is improved to a staggering 200%, approximately, compared to the built-in settings of the IDPS.

A categorical survey of state-of-the-art intrusion detection system-<i>Snort</i>

Internet has shown a tremendous growth in the last few years and along with it, the impact, quality and quantity of threats on it have also increased. Organisations are striving to find methods to protect their data and network from the existing and emerging threats. Defence and monitoring system have become an essential part of all organisations who want to secure their data against network threats. This paper presents a categorical survey on the various research techniques taken for improving the performance of open-source intrusion detection system, Snort – de facto in the field of intrusion detection and prevention. The pros and cons of all the techniques have been presented. A novel parallel architecture has been proposed to increase the performance of Snort-IDS in a high speed network. The architecture is based on the constituent protocol proportions of the network traffic.

A CATEGORICAL SURVEY OF STATE-OF-THE-ART INTRUSION DETECTION SYSTEM- SNORT

Internet has shown a tremendous growth in the last few years and along with it, the impact, quality and quantity of threats on it have also increased. Organisations are striving to find methods to protect their data and network from the existing and emerging threats. Defence and monitoring system have become an essential part of all organisations who want to secure their data against network threats. This paper presents a categorical survey on the various research techniques taken for improving the performance of open-source intrusion detection system, Snort – de facto in the field of intrusion detection and prevention. The pros and cons of all the techniques have been presented. A novel parallel architecture has been proposed to increase the performance of Snort-IDS in a high speed network. The architecture is based on the constituent protocol proportions of the network traffic.

Intrusion Detection and Response System Inspired by the Defense Mechanism of Plants

The security of resources in a corporate network is always important to the organization. For this reason, different techniques, such as firewall and intrusion detection systems, are important. Years of long research have resulted in the contribution of different advancements in these techniques. Artificial intelligence, machine learning techniques, soft computing techniques, and bio-inspired techniques have been efficient in detecting advanced network attacks. However, very often, different new attacks are most successful in breaching these detection techniques. This very reason has been a motivation for us to explore the biological aspects and its defense mechanisms for designing a secure network model. After much study, we have identified that plants have a very well-established and evolved detection and a response mechanism to pathogens. In this paper, we have proposed and implemented a network attack detection and a response model inspired by plants. It is a three-layered model in analogy to the three-layer defense mechanism of plants to pathogens. We have further tested the proposed model to different network attacks and have compared the results to the open-source intrusion detection system, Snort. The experimental results also establish that the model is competent to detect and trigger an automated response whenever required.

Performance comparison of intrusion detection systems and application of machine learning to Snort system

This study investigates the performance of two open source intrusion detection systems (IDSs) namely Snort and Suricata for accurately detecting the malicious traffic on computer networks. Snort and Suricata were installed on two different but identical computers and the performance was evaluated at 10 Gbps network speed. It was noted that Suricata could process a higher speed of network traffic than Snort with lower packet drop rate but it consumed higher computational resources. Snort had higher detection accuracy and was thus selected for further experiments. It was observed that the Snort triggered a high rate of false positive alarms. To solve this problem a Snort adaptive plug-in was developed. To select the best performing algorithm for Snort adaptive plug-in, an empirical study was carried out with different learning algorithms and Support Vector Machine (SVM) was selected. A hybrid version of SVM and Fuzzy logic produced a better detection accuracy. But the best result was achieved using an optimised SVM with firefly algorithm with FPR (false positive rate) as 8.6% and FNR (false negative rate) as 2.2%, which is a good result. The novelty of this work is the performance comparison of two IDSs at 10 Gbps and the application of hybrid and optimised machine learning algorithms to Snort.

Intrusion Detection of the ICS Protocol EtherCAT

Control mechanisms like Industrial Controls Systems (ICS) and its subgroup SCADA (Supervisory Control and Data Acquisition) are a prerequisite to automate industrial processes. While protection of ICS on process management level is relatively straightforward—well known office IT security mechanisms can be used—protection on field bus level is harder to achieve as there are real-time and production requirements like 24x7 to consider. One option to improve security on field bus level is to introduce controls that help to detect and to react on attacks. This paper introduces an initial set of intrusion detection mechanisms for the field bus protocol EtherCAT. To this end existing Ethernet attack vectors including packet injection and man-in-the-middle attacks are tested in an EtherCAT environment, where they could interrupt the EtherCAT network and may even cause physical damage. Based on the signatures of such attacks, a preprocessor and new rule options are defined for the open source intrusion detection system Snort demonstrating the general feasibility of intrusion detection on field bus level.

Visualizing web server attacks: patterns in PHPIDS logs‡

AbstractThe prevalence and severity of application‐layer vulnerabilities increase dramatically their corresponding attacks. In this paper, we present an extension to PHPIDS, an open source intrusion detection and prevention system for PHP‐based web applications, to visualize its security log. Our usage of security data visualization is motivated by the fact that most security defense systems are mainly based on text‐based logs for recording security‐related events, which are difficult to analyze and correlate. The proposed extension analyzes PHPIDS logs, correlates these logs with the corresponding web server logs, and plots the security‐related events. We use a set of tightly coupled visual representations of hypertext transfer protocol server requests containing known and suspicious malicious content, to provide system administrators and security analysts with fine‐grained visual‐based querying capabilities. We present multiple case studies to demonstrate the ability of our PHPIDS visualization extension to support security analysts with analytic reasoning and decision making in response to ongoing web server attacks. Experimenting the proposed PHPIDS visualization extension on real‐world datasets shows promise for providing complementary information for effective situational awareness. Copyright © 2014 John Wiley & Sons, Ltd.

A Fast Regular Expressions Matching Algorithm for NIDS

In this paper, we propose a new algorithm to accelerate the searching speed in network intrusion detection system (NIDS) and we implement our algorithm in Snort, a popular open-source intrusion detection system. The algorithm is based on the fact that normal data stream rarely matches any virus signature and different packets need to check different keys. The algorithm does not need preprocessing and can check multiple characters in parallel. Experimental results show that our implementation is faster than original NFA/DFA based algorithms to deal with the same real packet traces while consuming an order of magnitude less memory.

Approaches for improving the performance of snort Intrusion Detection Systems

The process of monitoring the events occurring in a computer system or network and analyzing them for sign of intrusions is known as intrusion detection systems (IDS).In this paper the architecture of the snort which is an open source Intrusion detection system is explained. It is a rule based system hence the structure of the rule is also explained. But to match with the high speed of network traffic the performance of the SNORT need to be improved hence the various methods has been developed three of them are reviewed here which are Rules Matching Algorithm Based on Dynamic Adjustment, NAPI and LASSP.

A regular expression matching circuit: Decomposed non-deterministic realization with prefix sharing and multi-character transition

This paper shows a compact realization of regular expression matching circuits on FPGAs. First, the given regular expression is converted into a non-deterministic finite automaton (NFA) by the modified McNaughton-Yamada method. Second, to reduce the number of the states in the NFA, prefixes for the NFA are shared. Also, the NFA is converted into the NFA with multi-character transition (MNFAU: Modular non-deterministic finite automaton with unbounded string transition). Third, the MNFAU is decomposed into the transition string part and the state transition part. The transition string part is represented by the Aho-Corasic deterministic finite automaton (AC-DFA), and it is implemented by an off-chip memory and a register. On the other hand, the state transition part is implemented by a cascade of logic cells (LCs) and the interconnection on the FPGA. We implemented the regular expressions for SNORT (an open source intrusion detection system) on a Xilinx FPGA. Experimental results showed that, the embedded memory size per a character of the MNFAU is reduced to 0.2% of the pipelined DFA; 4.2% of the bit-partitioned DFA; 41.0% of the MNFAU (3); and 71.4% of the MNFAU without prefix sharing. Also, the number of LCs per a character of the MNFAU is reduced to 0.9% of the pipelined DFA; 15.6% of the NFA; and 80.0% of MNFAU without prefix sharing.