Analysis of open source intrusion detection systems with open rulesets

With the development of internet technologies, there is an increase in cyber attacks. As a result, various systems have been developed to detect and prevent cyber attacks. The most widely used open source and network-based intrusion detection systems are Snort and Suricata, while the most widely used open source and host-based intrusion detection systems are OSSEC and Wazuh. In this study, the efficiency of the latest versions of Snort and Suricata in detecting attacks with default configurations and using open rule sets is comparatively analyzed, while the detection efficiency of OSSEC and Wazuh as host-based intrusion detection systems are examined. In order to measure the detection efficiency, the ratio of the number of alarms generated to the total number of attacks was calculated. Community Rule Set, Registered Rule Set, Talos Rule Set, Emerging Threats Rule Set and Broadcom Rules were used as open rule set in the study. In the experiments, detection efficiency and false positive alarm generation amounts of intrusion detection systems were analyzed by using 600 different attack traffic and 38 different benign traffic. As attack traffic, there are traffic in three different categories: web application attacks, malware traffic and CVE referenced vulnerability exploitation traffic. During the experiments, it was aimed to measure the detection efficiency of Snort and Suricata intrusion detection systems by using rule sets alone, using all rule sets together, analyzing malware traffic according to threat actors, and analyzing CVE-referenced vulnerability exploitation attacks according to platforms and operating systems. On the other hand, web application attack traffics and CVE-referenced vulnerability exploitation traffics were sent to the OSSEC and Wazuh intrusion detection systems, and alarm generation situations were analyzed, and then the alarms that would occur after a successful attack were examined. As a result of the experiments, it has been seen that the most effective results are obtained with the Talos Rule Set when the rule sets are used separately in attack traffic, and when all rule sets are used together, the Snort intrusion detection system is more effective detecting attacks than Suricata in all three attack types. It has been analyzed that Talos Rule Set and Emerging Threats Rule Set do not create false positive alarms when all rule sets are used alone in benign traffic, and Suricata generates fewer false positive alarms when all rule sets are used together in benign traffic. It has been observed that the OSSEC and Wazuh Intrusion Detection Systems didn't create alarms in unsuccessful attacks, but it generates too many false positive alarms from the usual commands of the users.