Article Per Year (5 Year)
p-Index From 2021 - 2026
0.23
P-Index
This Author published in this journals
All Journal Sinkron : Jurnal dan Penelitian Teknik Informatika
Ichsan Ibrahim
Faculty of Information Technology, Sekolah Tinggi Manajemen Informatika dan Komputer Indonesia Mandiri, Bandung, Indonesia
Computer Science & IT

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
Comparative Analysis of Snort, Suricata, and Random Forest for Flood Detection Ichdan Maulana Nur Fazri; Ichsan Ibrahim
Sinkron : jurnal dan penelitian teknik informatika Vol. 10 No. 3 (2026): Article Research July 2026
Publisher : Politeknik Ganesha Medan

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.33395/sinkron.v10i3.16077

Abstract

Volumetric Denial of Service (DoS) attacks, particularly SYN Flood and ICMP Flood, remain critical threats to network availability. Signature-based NIDS tools such as Snort and Suricata are widely deployed, yet their trade-offs against machine learning approaches remain underexplored in simultaneous physical-environment studies. This study aims to quantify and compare the performance-accuracy trade-off of Snort 3, Suricata 7, and Random Forest for SYN/ICMP Flood detection on identical physical datasets. Experiments were conducted in a controlled physical laboratory using hping3-generated datasets: 28,930,364 ICMP packets (1.56 GB) and 1,532,301 SYN packets, each captured over 120 seconds. Both NIDS tools were tested in offline PCAP-replay mode. A Random Forest model was trained on 627,788 balanced samples using frame-level features, validated with 5-fold cross-validation. Results: Snort 3 achieved the highest throughput at 987,966 PPS (ICMP) and 240,908 PPS (SYN), while Suricata 7 demonstrated greater detection sensitivity with 148 alerts versus 36 matches in the ICMP scenario. The Random Forest classifier achieved Precision = Recall = F1-score = 1.00 on 125,558 test samples, confirmed by 5-fold cross-validation (99.98% ± 0.01%). Conclusion: A hybrid architecture combining signature-based NIDS as a first-line filter with Random Forest as a secondary validator represents the optimal configuration for volumetric DoS mitigation, balancing throughput and detection accuracy.
Co-Authors Ichdan Maulana Nur Fazri