Dynamical analysis of diversity in rule-based open source network intrusion detection systems

Abstract

Diverse layers of defence play an important role in the design of defence-in-depth architectures. The use of Intrusion Detection Systems (IDSs) are ubiquitous in this design. But the selection of the “right” IDSs in various configurations is an important decision that the security architects need to make. Additionally, the ability of these IDSs to adapt to the evolving threat-landscape also needs to be investigated. To help with these decisions, we need rigorous quantitative analysis. In this paper, we present a diversity analysis of open-source IDSs, Snort and Suricata, to help security architects tune/deploy these IDSs. We analyse two types of diversities in these IDSs; configurational diversity and functional diversity. In the configurational diversity analysis, we investigate the diversity in the sets of rules and the Blacklisted IP Addresses (BIPAs) these IDSs use in their configurations. The functional diversity analysis investigates the differences in alerting behaviours of these IDSs when they analyse real network traffic, and how these differences evolve. The configurational diversity experiment utilises snapshots of the rules and BIPAs collected over a period of 5 months, from May to October 2017. The snapshots have been collected for three different off-the-shelf default configurations of the Snort IDS and the Emerging Threats (ET) configuration of the Suricata IDS. The functional diversity investigates the alerting behaviour of these two IDSs for a sample of the real network traffic collected in the same time window. Analysing the differences in these systems allows us to get insights into where the diversity in the behaviour of these systems comes from, how does it evolve and whether this has any effect on the alerting behaviour of these IDSs. This analysis gives insight to security architects on how they can combine and layer these systems in a defence-in-depth deployment.

Strengthening Network Security: Evaluation of Intrusion Detection and Prevention Systems Tools in Networking Systems

“…In contrast, the results of this research delve into practical IDPS implementation within a networking system environment to defend against specific threats, emphasizing real-world application. The studies cited as [11], [12], [29], [30], [33], [36]- [38], on the other hand, differ significantly from this research outcome. Given these variations in goals and approaches, direct result comparisons can be challenging.…”

“…Contributions from other research, as presented in the studies by [33]- [38], also provide valuable insights within the domain of IDPS. Researchers examine diversity analysis for open-source IDS, aiding security architects in optimizing system performance.…”

“…It explores the trade-off between security and QoS, demonstrating how enhancing security can lead to improved performance, albeit with some trade-offs. The study by [33] employs a multi-objective Bat algorithm to optimize security and QoS in a real-time operating system. It efficiently selects optimal security policies, ensuring minimal disruptions to Quality of Service.…”

A Perspective-Retrospective Analysis of Diversity in Signature-Based Open-Source Network Intrusion Detection Systems

“…For the detailed inside architecture of an IDS, see [2]. Signature based IDSs use rules that usually have various fields-actions, protocols, source/destination IP, source/destination ports, message to be stored/displayed, regular expressions for payload etc.…”

“…This study improves upon the previous work by utilizing labelled PCAP data in conducting individual and cross-platform diversity analysis of Snort and Suricata IDSs. In addition, the study uses a larger rule set spanning four years, from 2017 to 2020, compared to [2], where the functional diversity analysis was based on a two-week rule set. The analysis involves two ex-periments using two different PCAP datasets from the Canadian Institute for Cybersecurity (CIC), CIC-IDS-2017 and CSE-CIC-IDS2018 [3], collected on July 6, 2017, andbetween Feb 22-23, 2018, respectively.…”