<![CDATA[Network security on web servers is a crucial element for ensuring service availability. Slowloris represents a low-rate variant of the Denial-of-Service (DoS) attack, leveraging HTTP connection handling mechanisms by submitting perpetually incomplete requests, which deplete server connection slots without necessitating high bandwidth. This study evaluated Suricata as an Intrusion Detection System (IDS) on an Apache web server through 50 controlled Slowloris attack simulations within a VirtualBox virtual environment running Ubuntu 24.04 LTS. Three performance parameters were analyzed: (1) Detection speed, quantified as the elapsed time from attack initiation to alert generation in fast.log; (2) Detection rate (True Positive Rate), determined via a confusion matrix; and (3) System resource consumption of the Suricata process (CPU, RAM, and bandwidth). Results indicated an average Detection time of 0.346 seconds (minimum 0.168 seconds, maximum 0.979 seconds), an average detection rate of 72.84% (minimum 50.00%, maximum 94.12%), a mean CPU increase of 5.22 percentage points (from 2.03% baseline to 7.25% under attack), a 6.39 MB (59.85 to 66.24 MB) increase in RAM, and a 256.72 kbps increase in bandwidth. No false positives were consistently observed across all 50 trials. Cross-parameter analysis uncovered a non-linear relationship between detection time and detection rate, with an empirically validated optimal detection-time range of 0.25 to 0.35 seconds associated with peak detection rates above 90%, and a positive correlation (r = 0.468) between attack bandwidth intensity and Detection accuracy. These findings confirmed Suricata’s effectiveness as a lightweight early-warning mechanism for Slowloris mitigation on standard-specification web servers.]]>
