## 7 Methodology Applied in This Research
### Evaluation of the Hybrid IDS-Cisco Fiepower in a Live Office Network
#### 7.2.2 Analysis and Findings
Figure 10 below was particularly interesting because it identified all the application protocol information and the types of Traffic by risk and application. Figure 10 above shows HTTP, RDS and DNS are amongst the top traffic going through the network that contributes to the risk applied on the network. Monitoring these protocols and their behaviour and what they connect to will allow the detection to be positive and react with the right prevention mechanism in place. Findings further showed that during the setup process of the Firepower, the Cisco IPS used the signature-based approach for detection and prevention, as it was less of a strain on the computing power of the device and network. It also used less memory and impacted the CPU performance less on the IPS device permitting more signatures to be active as suggested by a blog on Cisco performance online based on its usage as defined in the experiment [55]. In accordance with Cisco, in order for the SME to move to a complete anomaly-based approach would mean that extra plug-in modules would have to be purchased to have  
Figure 10: Application Protocol Information: Traffic by Risk and Application extracted from Firepower. Figure 9: Intrusion Event by Impact extracted from Firepower. more ML featured available to test even further. The costs would reflect a rather high amount per month as Cisco relied on a subscription-based model for its customers to use the ML features to its full potential. The SME in this experiment did not buy into the extra modules due to their own monthly contract costs with the customers not reflecting the uses of the full potential of ML features. The experiment only showed ML features that were already pre-prescribed and basic in the features and levels of intelligence supplied. Another cost implication would mean the increase in ML features having a direct impact on the cost of CPU performance which was not feasible due to the level of the cost incurred for the SME in question without having to cross charge this back to the SME customers. From this evaluation, it was found that there are devices and software applications that can be combined to raise the detection and alert so that prevention can act faster and damage control can be managed. In order to reduce the main Cisco cost of using the full potential of ML features, SMEs businesses have to seek alternative protection to addresses advance anomaly-based approach ML to help benefit their NIDs from zero-day attacks by implementing the following into their network. Following are the three layers of ML techniques applied by SMEs from a cost perspective. * Anti-virus products that are effective for detecting malware that is active on the network that uses ML techniques. * Port access that is filtered efficiently by traditional firewalls that require manual intervention by engineering expertise within the SME. * Application firewalls control access to applications wall products by filtering input, output, and system service calls locally and over the network again manual process by engineering intervention. Cisco ASA with Firepower services brings distinctive, threat-focused, security services that provide comprehensive protection from known and advanced threats, including protection against targeted and persistent malware attacks. During the evaluation, there were modules of the Firepower that could only be triggered through a subscription model. The devices are very powerful but costly to run as the features increase and are switched on. Nonetheless, with its basic IDPS model in place, the device was able to provide the SME with statistics on a monthly basis to help protect the SME customer's environment in this ever-changing cyberspace and carry on protecting their data.