<![CDATA[Secure Shell (SSH) services are vulnerable to brute force attacks, yet literature remains limited in analyzing internal mechanisms affecting Detection Rate (DR) under high-speed attacks. This study analyzes Suricata Network Intrusion Detection System (NIDS) performance on Ubuntu Server 24.04 LTS using a quantitative experimental method. Suricata inspects port 22 traffic in real-time via signature-based rules. Evaluation began with False Positive Rate (FPR) testing, followed by two scenarios: Scenario I (baseline) and Scenario II (Suricata). Results showed FPR 0.000% (True Negative (TN) = 4, False Positive (FP) = 0). In Scenario I, Suricata was inactive, so no detection occurred. Scenario II recorded a DR of 86.969 ± 0.801%. DR below 100% was triggered by OpenSSH connection refusals when exceeding MaxStartups (10:30:100) sending TCP RST/RST-ACK packets, terminating sessions before Suricata finished reassembling packet data. Throughput was 19.677 Kbps (Scenario I) and 19.948 Kbps (Scenario II). Packet loss 0.000% (Scenario I) and 0.053% (Scenario II). Central Processing Unit (CPU) load was 3.099%. (Scenario I) and 4.332% (Scenario II), while Random Access Memory (RAM) load was 25.732 MB (Scenario I) and 18.162 MB (Scenario II), with idle RAM overhead 48.035 MB (2.345% of total RAM). Suricata proves precise and efficient, yet requires active mitigation.]]>
Copyrights © 2026
