Evaluación de las funcionalidades de los sistemas de detección de intrusos basados en la red de plataformas Open Source utilizando la técnica de detección de anomalías.

Abstract

The purpose of this research work is to evaluate the functionality of the intrusion detection systems (IDS) based on Open Source platforms using the anomalies detection technique, defining several concepts about intrusion detection systems. For the evaluation of the IDSes, a methodology based on the application and quasi-experimental research was used, considering the existing knowledge and the implementation of the cases of: learning, simulation of attacks and application by means of virtual scenarios, on which they were installed the Snort, Suricata and Bro IDSes and the different Benchmark tools. The correlation of the alerts issued by both Snort and Suricata using the anomaly detection technique based on statistical data, allowed to determine the true negative (TN) for the effective alerts and false positives (FP) for the anomalies. Regarding the functionality, it was determined that Suricata is 5% better than Snort; in terms of performance, it was determined that: Suricata at the time of analyzing the data set of DARPA 99 that consists of 44’894.776,00 of packages has a 0% of lost packages, comparing with Snort that has a 7.6%; with respect to the response times using the same data set, it is evident that Suricata uses a times of 484 seconds and on the other hand Snort takes it to perform the analysis in 1086 seconds; and regarding safety, Suricata offers a sensitivity of 33.37% in relation to Snort that has 25.63%. After the inferential statistical analysis through Z test, it is concluded that Suricata offers better features for information security than Snort, so it is recommended the implementation of Suricata considering the steps described in the manual of good practices of IDSes of Open Source platforms.