Affiliations: [a] EDGAR ONLINE, INC. 8715 First Avenue, #1413D, Silver Spring, MD 20910, USA. Tel.: +1 301 587 1408; Fax: +1 301 5871236; E-mail: ciheagwara@unateck.com | [b] School of Computing, University of Glamorgan, Pontypridd, Wales CF37 1DL, UK. Tel.: +44 1443 482245; Fax: +44 1443 482715; E-mail: ajcblyth@glam.ac.uk | [c] Gartener Group, Department of Computer Science, University of Kentucky, 301 Rose Street, Lexington, KY 40506, USA. Tel.: +1 859 257 3062; Fax: +1 859 323 3740; E-mail: singhal@cs.uky.edu
Abstract: Intrusion detection systems' (IDS) effectiveness requires balancing characteristics and elements so they fit together in appropriate compromises to create good network security systems. One major gauge for IDS effectiveness is the ability to detect attacks within operational specifications. Gigabit IDS sensors as opposed to Megabit IDS sensors promise dramatic increase in component performance and functional opportunities, possibly leading to dramatically changed system balance and overall performance. The research described here examines the system benefits of using a single Gigabit IDS sensor instead of multiple Megabit sensors for a wide range of defined system attacks, network traffic characteristics, and for their contexts of operational concepts and deployment techniques. The experimental results are analyzed in the context of practical experiences in the operation of these IDS systems. The difference in architectural designs, deployment strategies and operational concepts that characterized their performance in exploiting the strengths of attack systems are discussed.
