COMPARATIVE ANALYSIS OF SNORT AND SURICATA INTRUSION DETECTION SYSTEMS

 

Evgeny S. Semenov

Candidate of Sciences (Engineering), Associate Professor,

Head of the Department of Telecommunication Systems,

Volgograd State University
This email address is being protected from spambots. You need JavaScript enabled to view it.
Prosp. Universitetsky, 100, 400062 Volgograd, Russian Federation

 

Nikita R. Dmitrienko

Postgraduate Student, Department of Telecommunication Systems,

Volgograd State University
This email address is being protected from spambots. You need JavaScript enabled to view it.
Prosp. Universitetsky, 100, 400062 Volgograd, Russian Federation

 

Ivan F. Gladkov

Student, Department of Telecommunication Systems,

Volgograd State University
This email address is being protected from spambots. You need JavaScript enabled to view it.
Prosp. Universitetsky, 100, 400062 Volgograd, Russian Federation

 

Abstract. Different approaches to the organization of open-source intrusion detection systems are considered. In this context, network intrusion detection systems become an important element of network security, providing reliable protection against potential threats to the integrity, confidentiality, and availability of data in the network. Many network intrusion detection systems have been proposed in the literature, but Snort and Suricata are the best known and most common among open-source solutions. The paper compares the performance of these two network intrusion detection systems. A quantitative study was performed in a virtualized network environment to evaluate the performance of each system in terms of accuracy, memory and central processing unit usage, and packet processing speed, and packet loss rate. The study found that Snort and Suricata perform well but have some limitations that need to be addressed. During testing, Snort's intrusion detection system exhibited lower detection latency. At the same time, Suricata demonstrates higher detection accuracy due to a more comprehensive set of community-supplied rules. However, the higher processing requirements of Suricata caused this system to reach its operational limits faster than Snort.

 

Key words: IPS, NIDS, HIDS, Snort, Suricata.

 

This work is licensed under a Creative Commons Attribution 4.0 International License.