<![CDATA[Volumetric Denial of Service (DoS) attacks, particularly SYN Flood and ICMP Flood, remain critical threats to network availability. Signature-based NIDS tools such as Snort and Suricata are widely deployed, yet their trade-offs against machine learning approaches remain underexplored in simultaneous physical-environment studies. This study aims to quantify and compare the performance-accuracy trade-off of Snort 3, Suricata 7, and Random Forest for SYN/ICMP Flood detection on identical physical datasets. Experiments were conducted in a controlled physical laboratory using hping3-generated datasets: 28,930,364 ICMP packets (1.56 GB) and 1,532,301 SYN packets, each captured over 120 seconds. Both NIDS tools were tested in offline PCAP-replay mode. A Random Forest model was trained on 627,788 balanced samples using frame-level features, validated with 5-fold cross-validation. Results: Snort 3 achieved the highest throughput at 987,966 PPS (ICMP) and 240,908 PPS (SYN), while Suricata 7 demonstrated greater detection sensitivity with 148 alerts versus 36 matches in the ICMP scenario. The Random Forest classifier achieved Precision = Recall = F1-score = 1.00 on 125,558 test samples, confirmed by 5-fold cross-validation (99.98% ± 0.01%). Conclusion: A hybrid architecture combining signature-based NIDS as a first-line filter with Random Forest as a secondary validator represents the optimal configuration for volumetric DoS mitigation, balancing throughput and detection accuracy.]]>
Copyrights © 2026
