Development of an Intrusion Prevention System for Small and Medium-Sized Networks

Development of an Intrusion Prevention System for Small and Medium-Sized Networks
Abstract
Small and medium-sized enterprises (SMEs) account for over 90% of the global economy and two-thirds of employment worldwide, yet they face escalating cyber threats with limited resources for enterprise-grade security solutions . This project presents the design and development of an open-source Intrusion Prevention System (IPS) tailored to the operational constraints of small and medium-sized networks. The system integrates Suricata as the detection and prevention engine with OpenCanary honeypot for early-warning capability, deployed on cost-effective commodity hardware. A multi-layered architecture combines signature-based detection, anomaly monitoring, and automated response mechanisms. The IPS implements custom detection rules optimized for SME traffic patterns, with automated alerting through multiple channels for timely incident response. Experimental evaluation using the NIST penetration testing methodology against a deliberately vulnerable web application demonstrates successful detection and blocking of 8 out of 9 tested attack categories, including SQL injection, brute force, and exploitation attempts . Honeypot interactions provide valuable early-warning capability for reconnaissance activities. The system achieves practical detection performance while maintaining resource utilization suitable for SME environments.
Keywords: Intrusion Prevention System; SME Security; Suricata; OpenCanary; Open-Source Security; Network Security
Chapter 1: Introduction
1.1 Research Background
Small and medium-sized enterprises form the backbone of the global economy, accounting for over 90% of businesses and providing two-thirds of employment worldwide . Despite their economic significance, SMEs are increasingly targeted by malicious actors, with nearly 66% reporting experiencing a cyberattack within a 12-month period . This figure has continued to grow over the following decade as attackers recognize that SMEs often lack the sophisticated defenses deployed by larger organizations.
The threat landscape facing SMEs includes ransomware, spyware, Trojans, phishing, and denial-of-service attacks . Ransomware attacks can paralyze SMEs by encrypting critical files and demanding ransom payments, with operational impact and recovery time exacerbated by weak cyber hygiene practices including infrequent software updates and insufficient backup procedures . The human factor remains a persistent threat, as phishing and social-engineering campaigns continue to succeed despite periodic awareness efforts, indicating that training alone is insufficient and must be complemented by technical controls .
Structural constraints significantly weaken SME cybersecurity posture. Frameworks such as the NIST Cybersecurity Framework and ISO/IEC 27001 are often perceived as too complex or abstract for small businesses, requiring expertise that many SMEs lack . SMEs typically operate with limited security budgets, small IT teams, and diverse network setups, relying on basic security controls that lack advanced and continuous detection measures . The challenge is both organizational and technological, requiring tailored solutions that provide timely visibility into abnormal activity without imposing unsustainable operational burdens.
1.2 Problem Statement
Current intrusion prevention systems face significant barriers to adoption by SMEs:
Resource Constraints: Enterprise-grade security solutions require costly hardware, high maintenance, and specialized expertise that SMEs cannot provide . Commercial next-generation firewalls and IPS appliances often exceed the budgets available for small-scale deployments.
Complexity Barriers: Many security tools assume dedicated security personnel for configuration, tuning, and incident response. SMEs typically lack such staff, requiring solutions that are manageable by general IT administrators .
Detection Gaps: Basic signature-based tools deployed by many SMEs are incapable of detecting sophisticated or zero-day attacks . This creates a false sense of security while leaving organizations vulnerable to evolving threats.
Alert Fatigue: High false positive rates from poorly tuned detection systems overwhelm SME staff, leading to ignored alerts and missed genuine threats .
Deployment Challenges: Existing open-source solutions, while cost-effective, often require significant configuration and optimization to function effectively in SME environments .
1.3 Research Objectives
This project aims to design and develop an intrusion prevention system specifically tailored for small and medium-sized networks with the following objectives:
1. Implement an open-source IPS using Suricata on cost-effective commodity hardware suitable for SME budgets .
2. Integrate OpenCanary honeypot for early-warning detection of reconnaissance and lateral movement activities .
3. Develop custom detection rules optimized for SME traffic patterns and common attack vectors.
4. Implement automated response mechanisms including IP blocking and multi-channel alerting.
5. Achieve practical detection performance while maintaining resource utilization suitable for SME environments.
6. Provide an architecture that is manageable by non-specialist IT staff.
1.4 Thesis Structure
This thesis comprises five chapters. Chapter 1 introduces research background and objectives; Chapter 2 reviews intrusion detection and prevention technologies, open-source solutions, and SME-specific considerations; Chapter 3 presents the system architecture and design; Chapter 4 describes implementation details and evaluation results; Chapter 5 concludes and discusses future work.
Chapter 2: Literature Review
2.1 Intrusion Detection and Prevention Systems
Intrusion Detection Systems (IDS) are security tools designed to monitor network or system activities and identify suspicious behavior that may indicate a security breach . Their main function is to detect unauthorized access, attacks, or policy violations . Intrusion Prevention Systems (IPS) extend this capability by actively blocking detected threats rather than merely alerting administrators.
IDS can be classified according to their telemetry and placement, detection methodology, system architecture, and response and operations . For SME environments, the selection of IDS types must balance coverage, operational feasibility, and resource constraints. Four primary IDS types are relevant:
Host-Based IDS (HIDS): Operate at the end-device level, monitoring logs, system activity, file integrity, and user behavior to detect signs of compromise . HIDS are particularly relevant for SMEs with flat network architectures and limited segmentation, as they can detect local attacks and insider threats . However, deploying and maintaining agents on numerous endpoints requires continuous administrative effort, and HIDS introduce performance overhead on constrained systems .
Network-Based IDS (NIDS): Analyze network traffic and are typically deployed on network devices or dedicated monitoring nodes. NIDS provide visibility into network-level attacks and are more scalable than host-based approaches . Open-source NIDS solutions include Snort, Suricata, and Zeek .
Wireless IDS (WIDS): Monitor wireless network traffic for attacks targeting Wi-Fi infrastructure. Relevant for SMEs with wireless networks but not the primary focus for wired network protection.
Hybrid IDS: Combine multiple detection approaches for comprehensive coverage. Research demonstrates that modular hybrid IDS designed for SME operational constraints achieve 95.2% attack detection rate with a 4.1% false positive rate .
2.2 Open-Source NIDS/NIPS Solutions
Three prominent open-source network intrusion detection systems have been extensively evaluated for SME suitability:
Snort: A widely used NIDPS operating on a signature-based model . Snort supports both IDS and IPS modes, allowing for traffic monitoring and alert generation . Its architecture includes packet capturing, decoding, normalization, detection, and output generation . Snort 3 introduced multithreading, improving packet processing capabilities, though Snort 2 remains suitable for simpler network configurations . Research indicates Snort 3 demonstrates strong capabilities but requires more resources than alternatives .
Suricata: Developed by the Open Information Security Foundation (OISF) as an IDS/IPS and network monitoring tool . Unlike Snort, Suricata uses a multi-threaded architecture, enabling efficient packet processing . Comparative studies consistently find that Suricata outperforms Snort on Linux, especially at high speeds, with lower packet drop rates and better scalability in multi-core environments . Suricata achieves high true positive rates while minimizing false positives, which is essential for reducing alert fatigue among SME users .
Zeek: Operates solely in IDS mode and features a scalable architecture with workers for log transmission to a manager . Zeek supports anomaly-based detection, setting it apart from Snort and Suricata, which focus on misuse detection . However, Zeek has a limited number of default signatures and may be too slow to handle attacks in real time, though it excels in thorough logging and analysis .
2.3 Comparative Performance for SME Environments
A comprehensive study evaluating Snort, Suricata, and Zeek specifically in the context of SME networks found that Suricata consistently outperformed alternatives in scalability, resource efficiency, and detection accuracy . Key findings include:
• Suricata achieved high true positive rates while minimizing false positives, essential for reducing alert fatigue among SME users
• Snort 3, optimized with afpacket and hyperscan, demonstrated strong capabilities but required more resources
• Snort 2 struggled with high-volume traffic
• Zeek was lightweight but less effective in signature-based detection, though it excelled in monitoring anomalies
Research on optimization of IDS solutions for SMEs confirms that Suricata performs at its best under heavy traffic loads thanks to its robust, multi-threaded structure and direct use of AF packet . Zeek excels in recording everything thoroughly but can be too slow for real-time attack handling .
2.4 Honeypot Integration for Early Warning
Honeypots provide complementary detection capabilities by creating decoy services that should never receive legitimate traffic. Any interaction with honeypots indicates malicious activity, providing high-confidence alerts with minimal false positives.
OpenCanary is a lightweight honeypot solution that can be deployed alongside IDS/IPS systems. Research demonstrates that integrating Suricata with OpenCanary on a Raspberry Pi 5 platform provides valuable early-warning capabilities, with honeypot interactions detecting reconnaissance activities before they escalate . The total hardware cost for the complete setup was approximately $230, making it accessible for SME budgets .
A scalable honeypot solution for SMEs in cloud environments demonstrates that integrating honeypots with IDS, firewall, and cost-effective cloud platforms provides greater detection and security features compared to local deployment without heavy investment in network infrastructure .