Análise comparativa das ferramentas IDS Open Source Snort, Suricata e Zeek para detecção de ataques em redes IOT

Abstract

The exponential growth of Internet of Things (IoT) devices has significantly expanded the attack surface of critical infrastructures, making intrusion detection systems (IDS) indispensable components for the security of modern networks. This research presents a comparative analysis of the open-source tools Snort, Suricata, and Zeek, evaluating their effectiveness against a comprehensive set of threats, including DDoS, Port Scanning, Ransomware, and Web injection attacks, derived from the Edge-IIoTset dataset, with an exclusive focus on malicious traffic analysis. To conduct the experiments, the Dalton framework was employed for container orchestration, ensuring test isolation and reproducibility. As a methodological contribution, custom parsing scripts were developed and executed, which were essential for normalizing heterogeneous logs and accurately extracting detection metrics and resource consumption data. The results revealed distinct operational profiles: Snort achieved the highest precision (91.5%), making it suitable for minimizing false positives but ineffective in detecting complex attacks; Zeek attained the highest recall (94.0%) while maintaining CPU usage below 2%, standing out for its efficiency; and Suricata provided the best overall balance, with an F1-Score of 77.6%, in addition to demonstrating robustness under volumetric attack scenarios. Therefore, it is concluded that Suricata is the most suitable solution for IoT gateways due to its resilience and deep detection capabilities, whereas Zeek is recommended for IoT sensors with severe hardware constraints, where lightweight visibility is prioritized over active blocking.