A comparative analysis of Snort 3 and Suricata

Akram Abd Eldjalil Boukebous; Mohamed Islem Fettache; Gueltoum Bendiab; Stavros Shiaeles

doi:10.1109/GlobConET56651.2023.10150141

A comparative analysis of Snort 3 and Suricata

Akram Abd Eldjalil Boukebous^*, Mohamed Islem Fettache, Gueltoum Bendiab, Stavros Shiaeles

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

2433 Downloads (Pure)

Abstract

The threat of intrusion has become a reality in modern network infrastructures, especially with the increased usage of IoT devices, cloud computing and wireless telecommunications. In this context, Network intrusion detection systems (NIDS) are becoming strategic security solutions, offering thorough defence against potential threats to the integrity, confidentiality, and availability of the data on a network. Many NIDS systems have been proposed in the literature, but Snort and Suricata are the most known in the open-source market. This paper compares the performance of the two NIDS, especially with the release of Snort 3 which is considered as the next generation of the Snort NIDS by integrating new ideas such as multithreading, expanded bindings and better cross-platform support. The quantitative study is done in a virtualised network environment in order to measure the performance of each NIDS in terms of accuracy, memory and processor usage, packet processing rate and the number of packet losses of each NIDSs. From this study, we have concluded that Snort 3 has better performance than Snort 2 and both Snort 3 and Suricata perform well but are not perfect and have some limitations that should be tackled.

Original language	English
Title of host publication	2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023
Publisher	Institute of Electrical and Electronics Engineers Inc.
Number of pages	6
ISBN (Electronic)	9798350331790
ISBN (Print)	9798350331806
DOIs	https://doi.org/10.1109/GlobConET56651.2023.10150141
Publication status	Published - 16 Jun 2023
Event	2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023 - London, United Kingdom Duration: 19 May 2023 → 21 May 2023

Conference

Conference	2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023
Country/Territory	United Kingdom
City	London
Period	19/05/23 → 21/05/23

Keywords

Multithreaded
Network Security
NIDS
Signature-based detection
Snort
Suricata

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

Access to Document

10.1109/GlobConET56651.2023.10150141

A Comparative Analysis of Snort 3 and Suricata
© © 2023 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript (Post-print), 544 KB

Cite this

@inproceedings{6573396076ea44cf92d43715fe4b1318,

title = "A comparative analysis of Snort 3 and Suricata",

abstract = "The threat of intrusion has become a reality in modern network infrastructures, especially with the increased usage of IoT devices, cloud computing and wireless telecommunications. In this context, Network intrusion detection systems (NIDS) are becoming strategic security solutions, offering thorough defence against potential threats to the integrity, confidentiality, and availability of the data on a network. Many NIDS systems have been proposed in the literature, but Snort and Suricata are the most known in the open-source market. This paper compares the performance of the two NIDS, especially with the release of Snort 3 which is considered as the next generation of the Snort NIDS by integrating new ideas such as multithreading, expanded bindings and better cross-platform support. The quantitative study is done in a virtualised network environment in order to measure the performance of each NIDS in terms of accuracy, memory and processor usage, packet processing rate and the number of packet losses of each NIDSs. From this study, we have concluded that Snort 3 has better performance than Snort 2 and both Snort 3 and Suricata perform well but are not perfect and have some limitations that should be tackled.",

keywords = "Multithreaded, Network Security, NIDS, Signature-based detection, Snort, Suricata",

author = "Boukebous, {Akram Abd Eldjalil} and Fettache, {Mohamed Islem} and Gueltoum Bendiab and Stavros Shiaeles",

note = "Funding Information: This project received funding from the European Union{\textquoteright}s Horizon 2020 research and innovation programme under grant agreements 957406 and 101021936. The work reflects the authors{\textquoteright} view and the Agency is not responsible for any use that could be made from the information it contains. Publisher Copyright: {\textcopyright} 2023 IEEE.; 2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023 ; Conference date: 19-05-2023 Through 21-05-2023",

year = "2023",

month = jun,

day = "16",

doi = "10.1109/GlobConET56651.2023.10150141",

language = "English",

isbn = "9798350331806",

booktitle = "2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

address = "United States",

}

Boukebous, AAE, Fettache, MI, Bendiab, G & Shiaeles, S 2023, A comparative analysis of Snort 3 and Suricata. in 2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023. Institute of Electrical and Electronics Engineers Inc., 2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023, London, United Kingdom, 19/05/23. https://doi.org/10.1109/GlobConET56651.2023.10150141

TY - GEN

T1 - A comparative analysis of Snort 3 and Suricata

AU - Boukebous, Akram Abd Eldjalil

AU - Fettache, Mohamed Islem

AU - Bendiab, Gueltoum

AU - Shiaeles, Stavros

N1 - Funding Information: This project received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreements 957406 and 101021936. The work reflects the authors’ view and the Agency is not responsible for any use that could be made from the information it contains. Publisher Copyright: © 2023 IEEE.

PY - 2023/6/16

Y1 - 2023/6/16

N2 - The threat of intrusion has become a reality in modern network infrastructures, especially with the increased usage of IoT devices, cloud computing and wireless telecommunications. In this context, Network intrusion detection systems (NIDS) are becoming strategic security solutions, offering thorough defence against potential threats to the integrity, confidentiality, and availability of the data on a network. Many NIDS systems have been proposed in the literature, but Snort and Suricata are the most known in the open-source market. This paper compares the performance of the two NIDS, especially with the release of Snort 3 which is considered as the next generation of the Snort NIDS by integrating new ideas such as multithreading, expanded bindings and better cross-platform support. The quantitative study is done in a virtualised network environment in order to measure the performance of each NIDS in terms of accuracy, memory and processor usage, packet processing rate and the number of packet losses of each NIDSs. From this study, we have concluded that Snort 3 has better performance than Snort 2 and both Snort 3 and Suricata perform well but are not perfect and have some limitations that should be tackled.

AB - The threat of intrusion has become a reality in modern network infrastructures, especially with the increased usage of IoT devices, cloud computing and wireless telecommunications. In this context, Network intrusion detection systems (NIDS) are becoming strategic security solutions, offering thorough defence against potential threats to the integrity, confidentiality, and availability of the data on a network. Many NIDS systems have been proposed in the literature, but Snort and Suricata are the most known in the open-source market. This paper compares the performance of the two NIDS, especially with the release of Snort 3 which is considered as the next generation of the Snort NIDS by integrating new ideas such as multithreading, expanded bindings and better cross-platform support. The quantitative study is done in a virtualised network environment in order to measure the performance of each NIDS in terms of accuracy, memory and processor usage, packet processing rate and the number of packet losses of each NIDSs. From this study, we have concluded that Snort 3 has better performance than Snort 2 and both Snort 3 and Suricata perform well but are not perfect and have some limitations that should be tackled.

KW - Multithreaded

KW - Network Security

KW - NIDS

KW - Signature-based detection

KW - Snort

KW - Suricata

UR - http://www.scopus.com/inward/record.url?scp=85164260961&partnerID=8YFLogxK

U2 - 10.1109/GlobConET56651.2023.10150141

DO - 10.1109/GlobConET56651.2023.10150141

M3 - Conference contribution

AN - SCOPUS:85164260961

SN - 9798350331806

BT - 2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2023 IEEE IAS Global Conference on Emerging Technologies, GlobConET 2023

Y2 - 19 May 2023 through 21 May 2023

ER -

A comparative analysis of Snort 3 and Suricata

Abstract

Conference

Keywords

UN SDGs

Access to Document

Fingerprint

Cite this