A Performance Evaluation of Zeek-Based Intrusion Detection in Agricultural IoT Security

As agricultural networks become more connected, they face increased risks from cyber threats that can compromise the security of farming operations. In a previous study, we explored the potential of Zeek, an open-source Network Intrusion Detection System (NIDS), in securing IoT devices within agricultural scenarios. This initial work, conducted in a Raspberry Pi virtual environment, showed promise in detecting cyber threats through offline analysis of pcap files. However, the dynamic and unpredictable nature of active farming environments necessitates a more comprehensive evaluation of security solutions that cannot be fully captured in offline experiments alone. This paper extends our prior work by investigating Zeek's implementation under both offline and real-time conditions, addressing the need for a more thorough understanding of its performance in dynamic agricultural case studies. We deploy Zeek in a virtual environment, providing a controlled and isolated testing platform for our experiments. For offline analysis, we utilize pcap files from the Stratosphere laboratory dataset, containing a mix of genuine and malicious traffic. Then, real-time analysis is conducted using various network tools to simulate live attack scenarios. The study specifically examines Zeek's effectiveness in identifying and mitigating two critical types of cyber threats relevant to IoT agriculture: unauthorized access attempts and distributed denial of service (DDoS) attacks.