A Comparative Analysis of Snort and Dendritic Cell Algorithm in Intrusion Detection Systems

In this study, we compare the performance of snort and dendritic cell algorithm (DCA) as intrusion detection systems (IDS) based on several key metrics. The evaluation results show that DCA has a higher true positive rate (TPR) of 99.8% compared to snort which only reached 71.85%, indicating that DCA is more effective in detecting true positive. However, DCA also has a higher false positive rate (FPR) of 20.03% compared to snort's 1.97%, indicating that DCA tends to generate more false alarms. As a result of the high FPR, the overall accuracy of DCA (84.45%) is lower than snort (89.2%). Additionally, DCA evaluates a larger sample size (37,801) than Snort (27,227), indicating that DCA handles more data or cases in this evaluation. In conclusion, although DCA is superior in true positive detection, snort is more reliable in generating accurate alarms with fewer false alarms. The integration of these two methods can provide an optimal solution by exploiting the high sensitivity of DCA and the reliability of snort.