A Collaborative Intrusion Detection System Using Snort IDS Nodes
Traditional single-point intrusion detection systems (IDS) suffer from low detection accuracy and high false-positive rates under complex, large-scale network attacks. To address this, this paper proposes a lightweight collaborative intrusion detection system (CIDS). Built upon Snort-based distributed detection nodes, CIDS leverages a centralized SIEM platform (LogScale) to enable cross-node alert sharing, real-time correlation analysis, and false-positive suppression. It introduces a novel low-overhead collaborative architecture supporting elastic sensor deployment and unified log governance. Experimental evaluation under simulated advanced persistent threat (APT) and flooding attack scenarios demonstrates that CIDS significantly improves detection accuracy while reducing the false-positive rate by over 35%. The system effectively mitigates alert fatigue and validates the feasibility of large-scale, time-critical, resource-efficient collaborative intrusion detection.