Real-time application of OPF-based classifier in Snort IDS

Abstract

As the internet grows over the years, it is possible to observe an increase in the amount of data that travels on computer networks around the world. In a context in which the volume of data is continuously being renewed, from the perspective of the Computer Network Security area, it becomes a great challenge to protect, in terms of effectiveness and efficiency, today's computer systems. Among the primary security mechanisms employed in these environments, the Network Intrusion Detection Systems stand out. Although the signature-based detection approach of these tools is sufficient to combat known attacks, with the eventual discovery of new vulnerabilities, it is necessary to use anomaly-based detection approaches to mitigate the damage of unknown attacks. In the academic field, several studies have explored the development of hybrid approaches to improve the accuracy of these tools, with the aid of machine learning techniques. In this same line of research, this chapter aims at the application of these techniques for intrusion detection in a real-time environment using a popular and widely utilized tool, the Snort IDS. The presented results show that in certain attack scenarios, the anomaly-based detection approach can outperform the signature-based detection approach, with emphasis on the optimum-path forest, AdaBoost, Random Forests, decision tree, and support vector machine techniques. © 2022 Copyright