Influence of existing rule processing optimizations on the performance of the snort 3 network intrusion detection system

Abstract

Network intrusion detection systems (NIDS) are a key component of cybersecurity, working to warn, detect, and respond to potential network threats. They analyze network traffic to detect anomalous or malicious activity such as breach attempts, viruses, use of software exploits, and more. Intrusion detection systems should perform packet inspec-tion at or near cable speed to be highly effective. The speed of intrusion detection systems is critical because it allows timely mitigation of potential cyber threats, ensuring uninter-rupted operation of business processes. One of the most common and recognized tools in the field of NIDS is the intrusion detection system Snort, which has already proven itself as a powerful means of protecting networks. Snort 3 is an updated version of this system, and has multithreading, increased speed compared to Snort, greater modularity and other advantages[2], so we will concen-trate on it in the context of this article. The task of optimizing the operation of NIDS is very acute. Due to the variability and multifunctionality of existing systems, there is a wide field for analyzing and improv-ing the efficiency of NIDS both for specific tasks and for tasks of a broad profile. So many works look at the performance of Snort 3 compared to other intrusion detection sys-tems[3] in different types of infrastructures, which will help the user to find the best op-tion for himself. The purpose of the study is to consider the three main rule processing optimization algorithms used in the Snort 3 system, namely Fast Pattern, port-based and protocol-based clustering. For them, the basic implementation, modifications of the source code, which are necessary to disable the algorithm, as well as the impact of the algorithm on the overall speed of the system, will be described. Some results have shown a slight performance improvement when the optimization algorithms are disabled, this is on configurations with a small number of rules. In most cases, a clear drop in performance of 10% or more is noticeable. The biggest deteriora-tion in performance occurs when Fast Pattern operations are disabled, without this algo-rithm the deterioration can reach 20 times.