Benchmarking Snort and Suricata for Alert Usefulness, Behavioural Divergence, and Resource Efficiency Using Enterprise Attack Workloads

Abstract

Intrusion Detection Systems (IDSs) remain essential components of enterprise cybersecurity monitoring due to their ability to detect malicious activity, reconnaissance behaviour, policy violations, and protocol anomalies. Among open-source signature-based IDS platforms, Snort and Suricata are widely deployed in operational and research environments. Although prior studies have compared both platforms using throughput or detection-rate benchmarks, limited work has jointly examined behavioural divergence, actionable alert quality, and operational efficiency under realistic enterprise attack workloads. This paper presents a reproducible benchmarking framework for evaluating Snort and Suricata in a small enterprise testbed using controlled reconnaissance, authentication probing, web enumeration, vulnerability scanning, and application-layer attack traffic. The evaluation extends beyond aggregate alert counts through behavioural divergence analysis, actionable alert density, and repeated runtime and memory-efficiency measurements. Experimental results reveal substantial workload-dependent differences. Suricata generated substantially larger alert volumes during HTTP enumeration and vulnerability scanning, dominated by checksum, parser, and HTTP-mismatch events, whereas Snort produced substantially higher application-layer detections during advanced web probing, generating 3389 alerts compared with 223 from Suricata. Across five repeated performance trials per major workload, alert counts remained stable, while Snort exhibited substantially lower runtime and memory consumption than Suricata under the evaluated configurations. These findings demonstrate that raw alert volume does not necessarily imply greater operational usefulness and highlight the importance of behaviour-aware, statistically supported IDS benchmarking for enterprise deployment and SOC decision-making.