## 7 Methodology Applied in This Research
### Comparison: Observation of Cisco ASA 5516-X FirePower, SNORT and pfSense
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**NIDs Devices** & **Cisco-FirePower** & **SNORT** & **pfSense** \\ \hline
**Experiment** & Office—Live Data Center & Home & Hybrid—Home and Office \\ \hline \multirow{8}{*}{**Financial Costs**} & Software and Hardware: & Software and Hardware: & \begin{tabular}{c} Software and Hardware: \\ Free to download. Donation to \\ SNORT community. Hardware: \\ \end{tabular} \\  & \(\ell\)10K–\(\ell\)15K Capital, \(\ell\)5K over a & Free to download. Donation to \\  & period of 3 year subscription & SNORT community. Hardware: \\  & model for support and updates. & High spec PC; \(\ell\)1K–\(\ell\)2K \\  & Engineering Staff Cost: & Engineering Staff Cost: \\ \cline{2-3}  & \(\bar{\text{230K}}\)–\(\bar{\text{4}0\text{K}}\) salary per annum & \(\bar{\text{230K}}\)–\(\bar{\text{4}0\text{K}}\) salary per annum based & \(\bar{\text{Engineering Staff Cost}}\): \\  & based on experience & on experience & \(\bar{\text{230K}}\)–\(\bar{\text{4}0\text{K}}\) salary per annum based \\ \hline \multirow{8}{*}{**Rules**} & Rules cannot be changed, its & \multirow{2}{*}{\
\begin{tabular}{c} Rules can be changed and \\ control mechanism. Cisco also \\ have bought certain ML aspects \\ of SNORT and pfSense rules \\ and embedded them into their \\ algorithms. \\ \end{tabular} } & Rules can be changed and & Rules can be changed and & integrated very easily. Rules are \\  & control mechanism. Cisco also & simple to write; Rule based Content & simple to write; Rule based Content \\  & have bought certain ML aspects & Pattern Matching however requires \\  & of SNORT and pfSense rules & engineering knowledge susceptible &
\begin{tabular}{c} Pattern Matching however requires \\ engineering knowledge susceptible \\ to human error. \\ \end{tabular} \\  & and embedded them into their & to human error. & \\ \hline
**Types of IDS** & \begin{tabular}{c} Signature, Anomaly ML \\ features on subscription \\ \end{tabular} & \
\begin{tabular}{c} Signature, Anamoly, Machine \\ Learning \\ \end{tabular} &
\begin{tabular}{c} Signature, Anamoly, Machine \\ Learning \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: NIDS Device comparison. to be able to run confidently these rules in a commercial GDPR compliant environment. Without this expertise, the commercial sector would not be aware of how to manage this IDS moving forward. From this observation, it also came to light that Cisco as a technology vendor and market leader has already absorbed parts of SNORT and pfSense rules. This is largely due to their resourcing expertise. SNORT has been used to fill holes in commercial vendor's network-based intrusion detection tools, such as this Cisco FirePower. When a new attack makes its debut in the hacker community and signature updates are slow to come from the vendor, SNORT is then used to characterize the new attack by running it locally on a test network and determining its signature. The findings of this work suggest that it is easier for Cisco engineers to use those rules from SNORT and pfSense and embed them into the listing above than to release new codes of their own. Due to the fact that SNORT is a packet sniffer, this allows its machine learning algorithms to fit nicely within the Cisco framework. Following on from the observation and the findings above, it is now appropriate to bring the discussion to a conclusion in the next section.