A case study of three open source security management tools

Author

Kayacik, Hilmi Gunes ; Zincir-Heywood, A. Nur

Author_Institution

Fac. of Comput. Sci., Dalhousie Univ., Halifax, NS, Canada

fYear

2003

fDate

24-28 March 2003

Firstpage

101

Lastpage

104

Abstract

Three open source security management tools - Snort, Pakemon, and Argus $are benchmarked against the DARPA 1999 Intrusion Detection Evaluation Data Set. Performance is characterized using multiple performance metrics. Snort is found to have the best performance in terms of detection rate, however it creates more false positives than desired. The results show that different tools perform well under different attack categories; hence they can be run at the same time to increase the detection rate of attack instances.

Keywords

computer network management; performance evaluation; public domain software; telecommunication security; telecommunication traffic; Argus; DARPA 1999 Intrusion Detection Evaluation Data Set; Pakemon; Snort; attack categories; detection rate; false positives; multiple performance metrics; open source; security management tools; Computer aided software engineering; Computer science; Computer security; Data security; Information security; Intrusion detection; Local area networks; System testing; Telecommunication traffic; Traffic control;

fLanguage

English

Publisher

ieee

Conference_Titel

Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on

Print_ISBN

1-4020-7418-2

Type

conf

DOI

10.1109/INM.2003.1194165

Filename

1194165