A case study of three open source security management tools

Three open source security management tools - Snort, Pakemon, and Argus $are benchmarked against the DARPA 1999 Intrusion Detection Evaluation Data Set. Performance is characterized using multiple performance metrics. Snort is found to have the best performance in terms of detection rate, however it creates more false positives than desired. The results show that different tools perform well under different attack categories; hence they can be run at the same time to increase the detection rate of attack instances.