Analysis And Evaluation Snort, Bro, and Suricata as Intrusion Detection System Based on Linux Server

• Main Authors: Ridho, M. Faqih (Author), , Fatah Yasin Al Irsyadi, S.T., M.T (Author), , Yusuf Sulistyo Nugroho, S.T., M.Eng (Author)
• Format: Book
• Published: 2014.
• Subjects: Thesis; NonPeerReviewed
• Online Access: Connect to this object online
• Notes: https://eprints.ums.ac.id/31281/13/Naskah_Publikasi.pdf; https://eprints.ums.ac.id/31281/1/halaman_awal.pdf; https://eprints.ums.ac.id/31281/3/BAB_I.pdf; https://eprints.ums.ac.id/31281/4/BAB_II.pdf; https://eprints.ums.ac.id/31281/5/BAB_III.pdf; https://eprints.ums.ac.id/31281/7/BAB_IV.pdf; https://eprints.ums.ac.id/31281/9/BAB_V.pdf; https://eprints.ums.ac.id/31281/11/daftar_pustaka.pdf; https://eprints.ums.ac.id/31281/15/lampiran.pdf
• Keywords: QA76 Computer software

Security and confidentiality of data on computer networks is currently a problem that continues to grow. Installation of firewalls, antivirus, IDS (Intrusion Detection System) / IPS (Intrusion Prevention System) and various other security applications often require the best available installation cost is not small. Open source is the best solution to address the security issues that expensive. Intrusion Detection System is a system designed to collect information about the activities in the network, analyzing information, and give a warning. Snort, Bro and Suricata is an open source Intrusion Detection System. By comparing how the installation, configuration, warnings are displayed, and the resulting information can to know the advantages and disadvantages of snort Snort, Bro and Suricata as Intrusion Detection System. There are two stages of testing, such as scanning and penetration. Phase scanning is a scan of all ports, scanning is done by using NMAP application which is found on Armitage. Stage penetration is done by using the menu hail mary which is contained in Attack tab, hail mary is used to try all the exploits against computer target. Based on Scanning and penetration process, Snort detects 926 alert, Suricata detects 1218 alerts and Bro detects 128 low alerts. Snort and Suricata ease to install and update rule, Bro requires the least amount of resources.