An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers
With the vast usage of network services, Security became an important issue for all network types. Various techniques emerged to grant network security; among them is Network Intrusion Detection System (NIDS). Many extant NIDSs actively work against various intrusions, but there are still a number...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
University of Baghdad
2023-02-01
|
| Series: | Journal of Engineering |
| Subjects: | |
| Online Access: | https://joe.uobaghdad.edu.iq/index.php/main/article/view/1666 |
| _version_ | 1797782905042239488 |
|---|---|
| author | Sarah Abdulrezzak Firas Sabir |
| author_facet | Sarah Abdulrezzak Firas Sabir |
| author_sort | Sarah Abdulrezzak |
| collection | DOAJ |
| description |
With the vast usage of network services, Security became an important issue for all network types. Various techniques emerged to grant network security; among them is Network Intrusion Detection System (NIDS). Many extant NIDSs actively work against various intrusions, but there are still a number of performance issues including high false alarm rates, and numerous undetected attacks. To keep up with these attacks, some of the academic researchers turned towards machine learning (ML) techniques to create software that automatically predict intrusive and abnormal traffic, another approach is to utilize ML algorithms in enhancing Traditional NIDSs which is a more feasible solution since they are widely spread. To upgrade the detection rates of current NIDSs, thorough analyses are essential to identify where ML predictors outperform them. The first step is to provide assessment of most used NIDS worldwide, Snort, and comparing its performance with ML classifiers. This paper provides an empirical study to evaluate performance of Snort and four supervised ML classifiers, KNN, Decision Tree, Bayesian net and Naïve Bays against network attacks, probing, Brute force and DoS. By measuring Snort metric, True Alarm Rate, F-measure, Precision and Accuracy and compares them with the same metrics conducted from applying ML algorithms using Weka tool. ML classifiers show an elevated performance with over 99% correctly classified instances for most algorithms, While Snort intrusion detection system shows a degraded classification of about 25% correctly classified instances, hence identifying Snort weaknesses towards certain attack types and giving leads on how to overcome those weaknesses.
es.
|
| first_indexed | 2024-03-13T00:18:32Z |
| format | Article |
| id | doaj.art-9d776944a58843c2b663363522235c39 |
| institution | Directory Open Access Journal |
| issn | 1726-4073 2520-3339 |
| language | English |
| last_indexed | 2024-03-13T00:18:32Z |
| publishDate | 2023-02-01 |
| publisher | University of Baghdad |
| record_format | Article |
| series | Journal of Engineering |
| spelling | doaj.art-9d776944a58843c2b663363522235c392023-07-11T18:35:28ZengUniversity of BaghdadJournal of Engineering1726-40732520-33392023-02-0129210.31026/j.eng.2023.02.11An Empirical Investigation on Snort NIDS versus Supervised Machine Learning ClassifiersSarah Abdulrezzak0Firas SabirUniversity of Baghdad With the vast usage of network services, Security became an important issue for all network types. Various techniques emerged to grant network security; among them is Network Intrusion Detection System (NIDS). Many extant NIDSs actively work against various intrusions, but there are still a number of performance issues including high false alarm rates, and numerous undetected attacks. To keep up with these attacks, some of the academic researchers turned towards machine learning (ML) techniques to create software that automatically predict intrusive and abnormal traffic, another approach is to utilize ML algorithms in enhancing Traditional NIDSs which is a more feasible solution since they are widely spread. To upgrade the detection rates of current NIDSs, thorough analyses are essential to identify where ML predictors outperform them. The first step is to provide assessment of most used NIDS worldwide, Snort, and comparing its performance with ML classifiers. This paper provides an empirical study to evaluate performance of Snort and four supervised ML classifiers, KNN, Decision Tree, Bayesian net and Naïve Bays against network attacks, probing, Brute force and DoS. By measuring Snort metric, True Alarm Rate, F-measure, Precision and Accuracy and compares them with the same metrics conducted from applying ML algorithms using Weka tool. ML classifiers show an elevated performance with over 99% correctly classified instances for most algorithms, While Snort intrusion detection system shows a degraded classification of about 25% correctly classified instances, hence identifying Snort weaknesses towards certain attack types and giving leads on how to overcome those weaknesses. es. https://joe.uobaghdad.edu.iq/index.php/main/article/view/1666NIDSSnortKNNDecision TreeNaïve BaysWeka |
| spellingShingle | Sarah Abdulrezzak Firas Sabir An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers Journal of Engineering NIDS Snort KNN Decision Tree Naïve Bays Weka |
| title | An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers |
| title_full | An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers |
| title_fullStr | An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers |
| title_full_unstemmed | An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers |
| title_short | An Empirical Investigation on Snort NIDS versus Supervised Machine Learning Classifiers |
| title_sort | empirical investigation on snort nids versus supervised machine learning classifiers |
| topic | NIDS Snort KNN Decision Tree Naïve Bays Weka |
| url | https://joe.uobaghdad.edu.iq/index.php/main/article/view/1666 |
| work_keys_str_mv | AT sarahabdulrezzak anempiricalinvestigationonsnortnidsversussupervisedmachinelearningclassifiers AT firassabir anempiricalinvestigationonsnortnidsversussupervisedmachinelearningclassifiers AT sarahabdulrezzak empiricalinvestigationonsnortnidsversussupervisedmachinelearningclassifiers AT firassabir empiricalinvestigationonsnortnidsversussupervisedmachinelearningclassifiers |