An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers

Abstract

With the vast usage of network services, Security became an important issue for all network types. Various techniques emerged to grant network security; among them is Network Intrusion Detection System (NIDS). Many extant NIDSs actively work against various intrusions, but there are still a number of performance issues including high false alarm rates, and numerous undetected attacks. To keep up with these attacks, some of the academic researchers turned towards machine learning (ML) techniques to create software that automatically predict intrusive and abnormal traffic, another approach is to utilize ML algorithms in enhancing Traditional NIDSs which is a more feasible solution since they are widely spread. To upgrade the detection rates of current NIDSs, thorough analyses are essential to identify where ML predictors outperform them. The first step is to provide assessment of most used NIDS worldwide, Snort, and comparing its performance with ML classifiers. This paper provides an empirical study to evaluate performance of Snort and four supervised ML classifiers, KNN, Decision Tree, Bayesian net and Naïve Bays against network attacks, probing, Brute force and DoS. By measuring Snort metric, True Alarm Rate, F-measure, Precision and Accuracy and compares them with the same metrics conducted from applying ML algorithms using Weka tool. ML classifiers show an elevated performance with over 99% correctly classified instances for most algorithms, While Snort intrusion detection system shows a degraded classification of about 25% correctly classified instances, hence identifying Snort weaknesses towards certain attack types and giving leads on how to overcome those weaknesses. es.

Machine learning-based PortScan attacks detection using OneR classifier

“…Super optimized TCP port surveyor (strobe) is a tool used to perform port scanning or probe service tasks in secure networks and systems running on the UNIX platform. 9 [20] An empirical study to assess Snort's efficacy against network attacks, probing, brute force, and DoS, along with four supervised machine learning classifiers: KNN, decision tree, Bayesian net, and naïve bayes. Using the weka tool, one can evaluate the snort metric, true alarm rate, F-measure, precision, and accuracy and compare them to the same metrics obtained from the use of machine learning algorithms.…”

“…A current research area is being shaped by articles on machine learning techniques, which are among the most widely published. Table 1 (in Appendix) [12]- [20] gives a brief summary of some recent breakthroughs and research in PortScan attack detection.…”

Machine learning-based intrusion detection system for detecting web attacks

“…Stein et al [20] constructed an IDS model with artificial neural networks (ANN) based on the same dataset. Authors in [21], [22] proposed the use of decision trees and random forest. In addition, a hybrid approach combining two or more ML algorithms was presented in [23].…”