A realistic experimental comparison of the Suricata and Snort intrusion-detection systems

Proceedings - 26th IEEE International Conference on Advanced Information Networking and Applications Workshops, WAINA 2012

Volumn , Issue , 2012, Pages 122-127

  Albin, Eugene ^a   Rowe, Neil C ^a  

^a NAVAL POSTGRADUATE SCHOOL   (United States)

Author keywords

computer networks; intrusion detection; performance; Snort; Suricata

Indexed keywords

EXPERIMENTAL COMPARISON; INTRUSION DETECTION SYSTEMS; MALICIOUS PACKETS; MEMORY REQUIREMENTS; MULTI-THREADING; OPEN-SOURCE; PERFORMANCE; PROCESSING SPEED; REAL TIME; SET OF RULES; SNORT; SURICATA; TWO-PRODUCT;

COMPUTER NETWORKS; SUPERCOMPUTERS;

INTRUSION DETECTION;

EID: 84860704867     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/WAINA.2012.29     Document Type: Conference Paper

References (11)

1. D. Kuipers and M. Fabro, "Control System Cyber Security: Defense in Depth Strategies," No. INL/EXT-06- 11478, 2006
2. G. Kumar and S. Panda, "Spectrum of Effective Security Trust Architecture to Manage Interception of Packet Transmission in Value Added Network," The Global Journal of Computer Science and Technology, Vol. 11, No. 4, pp. 73-77, 2011.
3. B. Caswell, J. Beale, and A. Baker, Snort IDS and IPS Toolkit. New York: Syngress, 2007.
4. M. Lococo, "Capacity Planning for Snort," retrieved October 2, 2011 from mikelococo.com/2011/08/snortcapacity-planning/.
5. T. Weber, "Network Iintrusion Detection - Keeping Up with Increasing Information Volume," SANS Institute, 2001.
6. P. Mell, V. Hu, R. Lippmann, J. Haines, and M. Zissman, "An Overview of Issues in Testing Intrusion Detection Systems.," retrieved October 4, 2011 from www.netsecurity.org.
7. D. Day and B. Burns, "A Performance Analysis of Snort and Suricata Network Intrusion Detection and Prevention Engines," Fifth International Conference on Digital Society, Gosier, Guadeloupe, pp. 187-192, 2011.
8. S. Damaye, "Suricata-Vs-Snort," retrieved from www.aldeid.com/wiki/Suricata-vs-snort, October 2, 2011.
9. E. Leblond, "Optimizing Linux on Multicore CPUs," retrieved September 18, 2011 from home.regit.org/2011/01/optimizing-suricata-on- amulticore-cpu/.
10. E. Albin, "A Comparative Analysis of the Snort and Suricata Intrusion-Detection Systems," M.S. thesis, U.S. Naval Postgraduate School, September 2011.
11. M. Watchinski, "Unusual Snort Performance Stats," retrieved October 2, 2011 from comments.gmane.org/gmane.comp.security.ids.snort.general/ 30527.