Um estudo comparativo da capacidade de detecção e desempenho dos Sistemas de Detecção e Prevenção de Intrusão Snort, Suricata e OSSEC

Abstract

It is notable the exponential growth of Internet-connected devices in recent years and this consequently generates a great deal of insecurity about whether or not it is protected against malicious attacks, and such tools assist in identifying possible attacks, many are not capable of containing any attack that the network or host suffers because they mostly act in passive mode, only notifying the administrator about activities that generate alerts in the monitored environment. Intrusion Detection and Prevention System (IDPS) are systems already consolidated and present in the reality of organizations that have a small or large network of interconnected computers. The main function of this type of tool is to detect intruders who want to perform malicious activities such as information theft and perform some instruction to stop any attack. The operation of an IDPS tool is basically to check and detect malicious behavior that occurs within a network or a simple host being monitored. For the implementation of IDPS it is necessary to know its operation and the minimum configurations, however, if this basic information is not considered there is a risk to use the incorrect Intrusion Detection and Prevention System, generating incorrect detections or making excessive use of computational resources. This work compares the Snort, Suricata, and OSSEC IDPS to evaluate the performance and detection rate of each of them, performing several intrusion tests and with numerous users generating traffic at the same time. To do this, we use the Pytbull tools, which generally a lot of intrusion attacks and the Iperf used to create all the traffic on the network. With the results, it was possible to identify how the IDPS behaved and which one presented more satisfactory results.