Snort-based Intrusion Detection System for Practical Computer Networks. Implementation and Comparative Study

      Аннотация: A significant amount of research has been done to evaluate the performance of Network Intrusion Detection System (NIDS). Most of the works were performed in a moderate traffic condition. It is not worth enough to analyse the NIDS performance based on non-realistic traffic flow and under limited conditions. In this project, authors introduce some realistic off-the-shelf hardware specification for performance evaluation and network design of the NIDS. The main goal is to evaluate the performance of an open-source NIDS called Snort. Despite a number of research works on the same area, this research brings a unique performance evaluation for modern operating systems and networks. In particular, this project proposes a best performing NIDS by introducing a parallel NIDS using Snort processors with a centralised database for network security implementation. An improved performance for enhanced network traffic is realised and verified through a comparative study. The work should help shed some light on dealing with attackers in a variety of practical network models and should be especially useful to professionals working on Computer and Communications fields in both industry and academia.

Ключевые слова: Intrusion detection system, Network Security, Network Security, Parallel Processing, Snort, network traffic monitoring, experimental performance evaluation