Development of hybrid intrusion detection system based on Suricata with pfSense method for high reduction of DDoS attacks on IPv6 networks - Praptodiyono, Supriyanto; Firmansyah, Teguh; Anwar, Muhamad Haerul; Wicaksana, Cakra Adipura; Pramudyo, Anggoro Suryo; Al-Allawee, Ali (Eastern-European Journal of Enterprise Technologies, 2023)
Distributed Denial of Service (DDoS) attacks is a problem in computer networks. DDoS attacks pose a significant threat to internet networks as they cause congestion and disrupt the optimal functioning of servers. Detecting the source of these attacks is essential for effective protection. Therefore, in this study, we propose a hybrid strategy that combines Suricata, an intrusion detection system (IDS), with pfSense, a firewall, to address DDoS attacks. Suricata, the IDS, can identify the destination of the attack, which allows pfSense, the Firewall, to block the attack by dropping packets sent by the attacker. As a result, by leveraging this combined approach, we have observed significant improvements in the quality of service (QoS). The results of our study indicate a 1.08 % increase in throughput value, from 1881.97 bytes to 902.44 bytes, demonstrating improved efficiency in data transmission. Additionally, we observed a 57.32 % increase in the average total number of packets sent, from 1382 packets to 3238 packets, indicating better network performance. Furthermore, the proposed strategy significantly reduced delay and jitter values. The delay value decreased by 88.78 %, from 90.76 ms to 10.18 ms, and the jitter value decreased by 88.99 %, from 181.85 ms to 20.03 ms. These improvements signify a notable reduction in latency and packet timing variations, leading to a smoother network experience. Another crucial aspect we evaluated was the CPU utilization. The proposed strategy resulted in a substantial decrease in CPU utilization by 81.23 %, from 78.3 % to 14.7 %. The combination of pfSense and Suricata has proven to be a successful approach, providing robust protection against DDoS attacks, including those utilizing IPv6. This research can be implemented as a solution on a campus ad-hoc network with limited computers