Article citationsMore>>

Day, D. and Burns, B. (2011) A Performance Analysis of Snort and Suricata Network Intrusion Detection and Prevention Engines. ICDS 2011, The 5th International Conference on Digital Society, 187-192.

has been cited by the following article:

• TITLE: A Decision Tree Classifier for Intrusion Detection Priority Tagging

  AUTHORS: Adel Ammar

  KEYWORDS: Intrusion Detection, Network Security, Snort, Machine Learning, Classification, Decision Tree

  JOURNAL NAME: Journal of Computer and Communications, Vol.3 No.4, April 16, 2015

  ABSTRACT: Snort rule-checking is one of the most popular forms of Network Intrusion Detection Systems (NIDS). In this article, we show that Snort priorities of true positive traffic (real attacks) can be approximated in real-time, in the context of high speed networks, by a decision tree classifier, using the information of only three easily extracted features (protocol, source port, and destination port), with an accuracy of 99%. Snort issues alert priorities based on its own default set of attack classes (34 classes) that are used by the default set of rules it provides. But the decision tree model is able to predict the priorities without using this default classification. The obtained tagger can provide a useful complement to an anomaly detection intrusion detection system.