🤖 AI Summary
Traditional single-point intrusion detection systems (IDS) suffer from low detection accuracy and high false-positive rates under complex, large-scale network attacks. To address this, this paper proposes a lightweight collaborative intrusion detection system (CIDS). Built upon Snort-based distributed detection nodes, CIDS leverages a centralized SIEM platform (LogScale) to enable cross-node alert sharing, real-time correlation analysis, and false-positive suppression. It introduces a novel low-overhead collaborative architecture supporting elastic sensor deployment and unified log governance. Experimental evaluation under simulated advanced persistent threat (APT) and flooding attack scenarios demonstrates that CIDS significantly improves detection accuracy while reducing the false-positive rate by over 35%. The system effectively mitigates alert fatigue and validates the feasibility of large-scale, time-critical, resource-efficient collaborative intrusion detection.
📝 Abstract
Intrusion Detection Systems (IDSs) are integral to safeguarding networks by detecting and responding to threats from malicious traffic or compromised devices. However, standalone IDS deployments often fall short when addressing the increasing complexity and scale of modern cyberattacks. This paper proposes a Collaborative Intrusion Detection System (CIDS) that leverages Snort, an open-source network intrusion detection system, to enhance detection accuracy and reduce false positives. The proposed architecture connects multiple Snort IDS nodes to a centralised node and integrates with a Security Information and Event Management (SIEM) platform to facilitate real-time data sharing, correlation, and analysis. The CIDS design includes a scalable configuration of Snort sensors, a centralised database for log storage, and LogScale SIEM for advanced analytics and visualisation. By aggregating and analysing intrusion data from multiple nodes, the system enables improved detection of distributed and sophisticated attack patterns that standalone IDSs may miss. Performance evaluation against simulated attacks, including Nmap port scans and ICMP flood attacks, demonstrates our CIDS's ability to efficiently process large-scale network traffic, detect threats with higher accuracy, and reduce alert fatigue. This paper highlights the potential of CIDS in modern network environments and explores future enhancements, such as integrating machine learning for advanced threat detection and creating public datasets to support collaborative research. The proposed CIDS framework provides a promising foundation for building more resilient and adaptive network security systems.