Title :
A case study of three open source security management tools
Author :
Kayacik, Hilmi Gunes ; Zincir-Heywood, A. Nur
Author_Institution :
Fac. of Comput. Sci., Dalhousie Univ., Halifax, NS, Canada
Abstract :
Three open source security management tools - Snort, Pakemon, and Argus $are benchmarked against the DARPA 1999 Intrusion Detection Evaluation Data Set. Performance is characterized using multiple performance metrics. Snort is found to have the best performance in terms of detection rate, however it creates more false positives than desired. The results show that different tools perform well under different attack categories; hence they can be run at the same time to increase the detection rate of attack instances.
Keywords :
computer network management; performance evaluation; public domain software; telecommunication security; telecommunication traffic; Argus; DARPA 1999 Intrusion Detection Evaluation Data Set; Pakemon; Snort; attack categories; detection rate; false positives; multiple performance metrics; open source; security management tools; Computer aided software engineering; Computer science; Computer security; Data security; Information security; Intrusion detection; Local area networks; System testing; Telecommunication traffic; Traffic control;
Conference_Titel :
Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on
Print_ISBN :
1-4020-7418-2
DOI :
10.1109/INM.2003.1194165
