AbstractRecently, crimes are cause in the internet by hacking to target one’s and the companies financial. Due to the massive crimes that are caused by digital convergence and ubiquitous IT system, it is clear that the amount of network packet which need to be processed are rising. The digital convergence and ubiquitous IT system caused the IDS (Intrusion Detection System) to process packets more than the past. Snort (version 2.x) is a leading open source IDS which has a long history but since it was built a long time ago, it has several limitations which are not fit for today’s requirements. Such as, it’s processing unit is in single threading. On the other hand, Suricara was built to cover Snorts these disadvantages. To cover massive amount of packets which are caused by digital convergence and ubiquitous IT system Suricata’s have the availability to process packets in multi-threading environment. In this paper we have analyzed and compared Snort and Suricata’s processing and detection rate to decide which is better in single threading or multi-threading environment.
[1]
Gabriel Maciá-Fernández,et al.
Anomaly-based network intrusion detection: Techniques, systems and challenges
,
2009,
Comput. Secur..
[2]
Martin Roesch,et al.
Snort - Lightweight Intrusion Detection for Networks
,
1999
.
[3]
M. Chakraborty,et al.
Study of snort-based IDS
,
2010,
ICWET.
[4]
Zhimin Zhou,et al.
The study on network intrusion detection system of Snort
,
2010,
2010 International Conference on Networking and Digital Society.
[5]
David J. Day,et al.
A performance analysis of Snort and Suricata Network Intrusion Detection and Prevention Engines
,
2011,
ICDS 2011.
[6]
Maria Papadaki,et al.
Investigating the problem of IDS false alarms: An experimental study using Snort
,
2008,
SEC.
[7]
Richard Bejtlich,et al.
The Practice of Network Security Monitoring: Understanding Incident Detection and Response
,
2013
.