These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Intrusion Detection Systems (IDSs) are integral to safeguarding networks by
detecting and responding to threats from malicious traffic or compromised
devices. However, standalone IDS deployments often fall short when addressing
the increasing complexity and scale of modern cyberattacks. This paper proposes
a Collaborative Intrusion Detection System (CIDS) that leverages Snort, an
open-source network intrusion detection system, to enhance detection accuracy
and reduce false positives. The proposed architecture connects multiple Snort
IDS nodes to a centralised node and integrates with a Security Information and
Event Management (SIEM) platform to facilitate real-time data sharing,
correlation, and analysis. The CIDS design includes a scalable configuration of
Snort sensors, a centralised database for log storage, and LogScale SIEM for
advanced analytics and visualisation. By aggregating and analysing intrusion
data from multiple nodes, the system enables improved detection of distributed
and sophisticated attack patterns that standalone IDSs may miss. Performance
evaluation against simulated attacks, including Nmap port scans and ICMP flood
attacks, demonstrates our CIDS's ability to efficiently process large-scale
network traffic, detect threats with higher accuracy, and reduce alert fatigue.
This paper highlights the potential of CIDS in modern network environments and
explores future enhancements, such as integrating machine learning for advanced
threat detection and creating public datasets to support collaborative
research. The proposed CIDS framework provides a promising foundation for
building more resilient and adaptive network security systems.