Comprehensive Performance Assessment on Open Source Intrusion Detection System

  • Fuad Mat IsaEmail author
  • Shahadan Saad
  • Ahmad Firdaus Ahmad Fadzil
  • Raihana Md Saidi
Conference paper


Several studies have been conducted where authors compared the performance of open source Intrusion detection systems, namely Snort and Suricata. However, these studies were mostly limited to either security indicators or performance measurements under the same operating system. The objective of this study is to provide a comprehensive analysis of both products in terms of several security and performance related indicators under two different operating systems. Experiments were conducted to evaluate the effects of open source intrusion detection and prevention systems; Snort and Suricata running on Windows and Linux operating system. Attack types on system such as resource usage, dropped packets rate and ability to detect intrusions serve as experiment benchmarks. From the result, Snort is shown to work better in Linux platform in terms of intrusion detection compared to Suricata. In terms of performance in windows platforms, Snort demonstrated lesser intrusion detection than its Linux-based execution. This is different with Suricata, with its Linux configuration shown to be unable to detect any attack executed. The results also indicated that Linux-based execution consumes more system resources than its windows-based counterpart.


Attacks Intrusion detection systems (IDS) Network Traffic Performance evaluation Snort Suricata 


  1. 1.
    Albin, E.: A comparative analysis of the Snort and Suricata intrusion-detection systems. Naval Postgraduate School, Monterey CA (2011)Google Scholar
  2. 2.
    Chakrabarti, S., Chakraborty, M., Mukhopadhyay, I.: Study of Snort-based IDS. In: Proceedings of the International Conference and Workshop on Emerging Trends in Technology, pp. 43–47. ACM (2010)Google Scholar
  3. 3.
    Saboor, A., Akhlaq, M., Aslam, B.: Experimental evaluation of Snort against DDoS attacks under different hardware configurations. In: 2013 2nd National Conference on Information Assurance (NCIA), pp. 31–37. IEEE (2013)Google Scholar
  4. 4.
    Day, D., Burns, B.: A performance analysis of Snort and Suricata network intrusion detection and prevention engines. In Fifth International Conference on Digital Society, Gosier, Guadeloupe, pp. 187–192 (2011)Google Scholar
  5. 5.
    Alhomoud, A., Munir, R., Disso, J.P., Awan, I., Al-Dhelaan, A.: Performance evaluation study of intrusion detection systems. Procedia Comput. Sci. 5, 173–180 (2011)CrossRefGoogle Scholar
  6. 6.
    Kacha, C., Shevade, K.A.: Comparison of different intrusion detection and prevention systems. Int. J. Emerg. Technol. Adv. Eng. 2(12), 243–245 (2012)Google Scholar
  7. 7.
    Albin, E., Rowe, N.C.: A realistic experimental comparison of the Suricata and Snort intrusion-detection systems. In: 2012 26th International Conference on Advanced Information Networking and Applications Workshops (WAINA), pp. 122–127. IEEE (2012)Google Scholar
  8. 8.
    White, J.S., Fitzsimmons, T., Matthews, J.N.: Quantitative analysis of intrusion detection systems: Snort and Suricata. SPIE Defense, Security, and Sensing, pp. 875704–875704 (2013)Google Scholar

Copyright information

© Springer Nature Singapore Pte Ltd. 2019

Authors and Affiliations

  • Fuad Mat Isa
    • 1
    Email author
  • Shahadan Saad
    • 1
  • Ahmad Firdaus Ahmad Fadzil
    • 1
  • Raihana Md Saidi
    • 1
  1. 1.FSKM, Universiti Teknologi MARAKampus JasinMalaysia

Personalised recommendations