Evaluation of the performance of ID systems in a switched and distributed environment: the RealSecure case study
With the phenomenal increase of unwarranted Internet traffic into corporate networks the need for the development and effective use of currently available intrusion detection (ID) systems has acquired great importance. Compounding this is the constantly evolving techniques by professional hackers to defeat any and every counter measure designed to stem or at least contain their acts. In this paper, we present the results of tests conducted to assess the effectiveness of intrusion detection system in a switched and distributed network environment. The results reveal that the performance of ID systems is a function of various factors including network topology, deployment techniques, and network throughput, bandwidth and network traffic conditions. Within the limits of our studies, the findings can be summarized as: The detection capability of the ID system diminishes with increase in bandwidth utilization with the obvious implication that better performance could be achieved with the use of multiple sensors. Deployment at network or domain entry points i.e. outside decoy provides better performance results by up to 11%. Deployment with packet loss limiting devices produces a better result than deployment with the port mirroring technique by up to 27%.
intrusion detection traffic analysis network security network surveillance