# Performance Comparison of Intrusion Detection Systems and Application of Machine Learning to Snort System

arXiv: https://arxiv.org/abs/1710.04843 · HTML: https://mlsanity.com/paper/1710.04843/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Oct 2017.

## Built on by (most cited first, 8 of 8)

- [Privacy and Trust Redefined in Federated Machine Learning](https://mlsanity.com/paper/2103.15753/) (2021)
- [Hybrid-Generative Diffusion Models for Attack-Oriented Twin Migration in Vehicular Metaverses](https://mlsanity.com/paper/2407.11036/) (2024)
- [A Hybrid Approach for an Interpretable and Explainable Intrusion Detection System](https://mlsanity.com/paper/2111.10280/) (2021)
- [Towards Network Traffic Monitoring Using Deep Transfer Learning](https://mlsanity.com/paper/2101.00731/) (2021)
- [Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers](https://mlsanity.com/paper/2409.00667/) (2024)
- [A Search Engine for Scientific Publications: a Cybersecurity Case Study](https://mlsanity.com/paper/2107.00082/) (2021)
- [Malware Squid: A Novel IoT Malware Traffic Analysis Framework using Convolutional Neural Network and Binary Visualisation](https://mlsanity.com/paper/2109.03375/) (2021)
- [Ransomware Detection using Process Memory](https://mlsanity.com/paper/2203.16871/) (2022)

## Abstract (arXiv)

This study investigates the performance of two open source intrusion detection systems (IDSs) namely Snort and Suricata for accurately detecting the malicious traffic on computer networks. Snort and Suricata were installed on two different but identical computers and the performance was evaluated at 10 Gbps network speed. It was noted that Suricata could process a higher speed of network traffic than Snort with lower packet drop rate but it consumed higher computational resources. Snort had higher detection accuracy and was thus selected for further experiments. It was observed that the Snort triggered a high rate of false positive alarms. To solve this problem a Snort adaptive plug-in was developed. To select the best performing algorithm for Snort adaptive plug-in, an empirical study was carried out with different learning algorithms and Support Vector Machine (SVM) was selected. A hybrid version of SVM and Fuzzy logic produced a better detection accuracy. But the best result was achieved using an optimised SVM with firefly algorithm with FPR (false positive rate) as 8.6% and FNR (false negative rate) as 2.2%, which is a good result. The novelty of this work is the performance comparison of two IDSs at 10 Gbps and the application of hybrid and optimised machine learning algorithms to Snort.