Comparative Analysis of Snort, Suricata, and Random Forest for Flood Detection
DOI:
10.33395/sinkron.v10i3.16077Keywords:
DDoS, Machine Learning, Network Intrusion Detection System, Random Forest, SuricataAbstract
Volumetric Denial of Service (DoS) attacks, particularly SYN Flood and ICMP Flood, remain critical threats to network availability. Signature-based NIDS tools such as Snort and Suricata are widely deployed, yet their trade-offs against machine learning approaches remain underexplored in simultaneous physical-environment studies. This study aims to quantify and compare the performance-accuracy trade-off of Snort 3, Suricata 7, and Random Forest for SYN/ICMP Flood detection on identical physical datasets. Experiments were conducted in a controlled physical laboratory using hping3-generated datasets: 28,930,364 ICMP packets (1.56 GB) and 1,532,301 SYN packets, each captured over 120 seconds. Both NIDS tools were tested in offline PCAP-replay mode. A Random Forest model was trained on 627,788 balanced samples using frame-level features, validated with 5-fold cross-validation. Results: Snort 3 achieved the highest throughput at 987,966 PPS (ICMP) and 240,908 PPS (SYN), while Suricata 7 demonstrated greater detection sensitivity with 148 alerts versus 36 matches in the ICMP scenario. The Random Forest classifier achieved Precision = Recall = F1-score = 1.00 on 125,558 test samples, confirmed by 5-fold cross-validation (99.98% ± 0.01%). Conclusion: A hybrid architecture combining signature-based NIDS as a first-line filter with Random Forest as a secondary validator represents the optimal configuration for volumetric DoS mitigation, balancing throughput and detection accuracy.
Downloads
References
Alduailij, M., Khan, Q. W., Tahir, M., Sardaraz, M., Alduailij, M., & Malik, F. (2022). Machine-Learning-Based DDoS Attack Detection Using Mutual Information and Random Forest Feature Importance Method. Symmetry, 14(6). https://doi.org/10.3390/sym14061095
Becerra-Suarez, F. L., Fernández-Roman, I., & Forero, M. G. (2024). Improvement of Distributed Denial of Service Attack Detection through Machine Learning and Data Processing. Mathematics, 12(9). https://doi.org/10.3390/math12091294
Bensaid, R., Labraoui, N., Abba Ari, A. A., Maglaras, L., Saidi, H., Abdu Lwahhab, A. M., & Benfriha, S. (2024). Toward a Real-Time TCP SYN Flood DDoS Mitigation Using Adaptive Neuro-Fuzzy Classifier and SDN Assistance in Fog Computing. Security and Communication Networks, 2024, 1–20. https://doi.org/10.1155/2024/6651584
Berríos, S., Garcia, S., Hermosilla, P., & Allende-Cid, H. (2025). A Machine-Learning-Based Approach for the Detection and Mitigation of Distributed Denial-of-Service Attacks in Internet of Things Environments. Applied Sciences (Switzerland), 15(11). https://doi.org/10.3390/app15116012
Boukebous, A. A. E., Fettache, M. I., Bendiab, G., & Shiaeles, S. (2023). A Comparative Analysis of Snort 3 and Suricata. 2023 IEEE IAS Global Conference on Emerging Technologies (GlobConET), 1–6. https://doi.org/10.1109/GlobConET56651.2023.10150141
Ghazi, D. S., Hamid, H. S., Zaiter, M. J., & Behadili, A. S. G. (2024). Performance and efficacy of Snort versus Suricata in intrusion detection: A benchmark analysis. 020024. https://doi.org/10.1063/5.0236936
Sahani, N., Zhu, R., Cho, J. H., & Liu, C. C. (2023). Machine Learning-based Intrusion Detection for Smart Grid Computing: A Survey. ACM Transactions on Cyber-Physical Systems, 7(2). https://doi.org/10.1145/3578366
Pawlicki, M., Kozik, R., & Choraś, M. (2024). The Impact of Data Scaling Approaches on Deep Learning, Random Forest and Nearest Neighbour-Based Network Intrusion Detection Systems for DoS Detection in IoT Networks (pp. 197–208). https://doi.org/10.1007/978-981-97-4465-7_14
Praptodiyono, S., Firmansyah, T., Anwar, M. H., Wicaksana, C. A., Pramudyo, A. S., & Al-Allawee, A. (2023). DEVELOPMENT OF HYBRID INTRUSION DETECTION SYSTEM BASED ON SURICATA WITH PFSENSE METHOD FOR HIGH REDUCTION OF DDOS ATTACKS ON IPV6 NETWORKS. Eastern-European Journal of Enterprise Technologies, 5(9(125)), 75–84. https://doi.org/10.15587/1729-4061.2023.285275
Sajid, M., Malik, K. R., Almogren, A., Malik, T. S., Khan, A. H., Tanveer, J., & Rehman, A. U. (2024). Enhancing intrusion detection: a hybrid machine and deep learning approach. Journal of Cloud Computing, 13(1). https://doi.org/10.1186/s13677-024-00685-x
Raharjo, D. H. K., & Muhammad Salman. (2023). ANALYZING SURICATA ALERT DETECTION PERFORMANCE ISSUES BASED ON ACTIVE INDICATOR OF COMPROMISE RULES. Jurnal Teknik Informatika (Jutif), 4(3), 601–610. https://doi.org/10.52436/1.jutif.2023.4.3.1013
Sawah, M. S., Elmannai, H., El-Bary, A. A., Lotfy, K., & Sheta, O. E. (2025). Distributed denial of service (DDoS) classification based on random forest model with backward elimination algorithm and grid search algorithm. Scientific Reports, 15(1). https://doi.org/10.1038/s41598-025-03868-x
Tahir, M., Wahyuningsih, U., Iyan, M., Pratama, P., & Effindi, A. (2024). Development of Network Security Using a Suricata-Based Intrusion Prevention System Against Distributed Denial of Service ARTICLE INFORMATION ABSTRACT (Vol. 6, Number 2). http://innovatics.unsil.ac.id
Uccello, F., Pawlicki, M., D’Antonio, S., Kozik, R., & Choraś, M. (2024). Towards Hybrid NIDS: Combining Rule-Based SIEM with AI-Based Intrusion Detectors (pp. 244–255). https://doi.org/10.1007/978-3-031-56950-0_21
Wang, R. C., & Avrianto, R. P. (2025). Improving Detection Accuracy of Network Intrusions Using a Hybrid Network Intrusion Detection System Based on Isolation Forest and Random Forest Algorithms. Jurnal Teknik Informatika (Jutif), 6(6), 5371–5385. https://doi.org/10.52436/1.jutif.2025.6.6.4694
Downloads
|
How to Cite
Issue
Section
License
Copyright (c) 2026 Ichdan Maulana Nur Fazri, Ichsan Ibrahim
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Muhammad Khoiruddin harahap
Google Scholar 
Moraref
PKP Index
Garuda Kemdikbud
Indonesia OneSearch
OCLC Worldcat
Dimensions
Index Copernicus
Scilit
