Analysing performance issues of opensource intrusion detection systems in highspeed networks Abstract   Driven by the growing data transfer needs, industry and research institutions are deploying 100xc2xa0Gbs networks. As such highspeed networks become prevalent, these also introduce significant technical challenges. In particular, an Intrusion Detection System (IDS) cannot process network activities at such a high rate when monitoring large and diverse traffic volumes, thus resulting in packet drops. Unfortunately, the high packet drop rate has a significant impact on detection accuracy. In this work, we investigate two popular opensource IDSs: Snort and Suricata along with their comparative performance benchmarks to better understand drop rates and detection accuracy in 100xc2xa0Gbs networks. More specifically, we study vital factors (including system resource usage, packet processing speed, packet drop rate, and detection accuracy) that limit the applicability of IDSs to highspeed networks. Furthermore, we provide a comprehensive analysis to show the performance impact on IDSs by using different configurations, traffic volumes and different flows. Finally, we identify challenges of using opensource IDSs in highspeed networks and provide suggestions to help network administrators to address identified issues and give some recommendations for developing new IDSs that can be used for highspeed networks.

IDSAIoT: An Intrusion Detection System Architecture for IoT Networks The Internet of Things (IoT) allows large amounts and variety of devices to connect, interact and exchange data. The IoT network creates numerous opportunities for novel attacks that can compromise information and systems integrity. Intrusion detection systems have been studied over two decades, mostly employing traditional data mining and machine learning techniques that require an offline phase for model training on large amounts of data. This paper presents three data stream novelty detection techniques applied to the intrusion detection problem and proposes IDSAIoT, a novel implementation architecture, which combines the use of resources at the edge of the network and a public cloud. After an extensive empirical evaluation, results show that it is possible to identify new attack patterns soon after their emergence and to adapt the models in an efficient way.