Top 6 Free Network Intrusion Detection Systems (NIDS) Software

Network intrusion detection systems (NIDS) attempt to detect cyber attacks, malware, denial of service (DoS) attacks or port scans on a computer network or a computer itself. NIDS monitor network traffic and detect malicious activity by identifying suspicious patterns in incoming packets. Any malicious activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. 

Why are NIDS Needed?

Due to the sophistication of cyber threats and data breaches, implementing and maintaining network security, data security and information security requires a defense in depth approach. Organizations need to secure their networks with a combination of technologies and detection methods designed to combat multiple attack vectors, intrusion and compromise methods available to cyber criminals today.

It's no longer enough to rely on a simple security system and antivirus software that can protect against known attacks at the application layer. 

A variety of tools and methodologies exist, however two common elements used to secure enterprise network configurations are the firewall and intrusion detection and intrusion prevention systems (IDS/IDPS). Firewalls control incoming and outgoing traffic based on rules and policies, acting as a barrier between secure and untrusted networks. 

Inside the secure network, an IDS/IDPS detects suspicious activity to and from hosts and within traffic itself, taking proactive measures to log and block attacks. 

The main difference between intrusion detection systems and intrusion prevention systems are that intrusion prevention systems are placed inline. This means they can actively prevent or block intrusions that are detected. IPS can send an alarm, drop malicious packets, reset a connection, block traffic from an offending IP address, correct cyclic redundancy check (CRC) errors, defragment packet streams, mitigate TCP sequencing issues and clean up unwanted transport and network layer options.

This post will focus on NIDS rather than host intrusion detection systems (HIDS) and intrusion prevention systems.

What is the Difference Between NIDS and HIDS?

IDS/IDPS offerings can be split into two solutions: network intrusion detection systems (NIDS) and host intrusion detection systems (HIDS).

NIDS are strategically positioned at various points in the network to monitor incoming and outgoing traffic to and from networked devices. NIDS solutions offer sophisticated, real-time intrusion detection capabilities, consisting of an assembly of interoperating pieces: a standalone appliance, hardware sensors and software components are common. These work in concert to allow a wider range of network intrusion detection capabilities than HIDS solutions.

In contrast, HIDS solutions are installed on every computer's operating system to analyze and monitor traffic coming to and from the device in question. HIDS also track and monitor local file changes and potential alterations due to unauthorized access and/or compromise. 

A comprehensive cyber security strategy will employ both NIDS and HIDS since each comes with distinct advantages and disadvantages. 

For example, since HIDS are host-installed and have access to details such as registry settings, logs and other system information, they can make IP address attribution and digital forensics more accessible. However, resources are drawn from the host (e.g. the computer the HIDS is installed on) to power the HIDS and HIDS are reactive in nature and can only respond to an attack after it has occurred. 

In contrast, NIDS are usually hardware installed on the network itself and don't tap into any underlying network devices for resources. The installation of NIDS tends to be simple too, simply drop them into the network to begin monitoring for suspicious traffic. However, NIDS are usually expensive and targeted at the enterprise user. 

That said, there are a decent selection of free, open-source NIDS solutions available based on commodity hardware that offer comparable levels of security and protection as commercial NIDS offerings. 

Before we can jump into what free NIDS offerings are available, another distinction must be made concerning how different types of NIDS detect intrusions.

What is the Difference Between Signature-Based NIDS and Anomaly-Based NIDS?

NIDS can incorporate one or both types of intrusion detection: signature-based and anomaly-based. 

A signature-based NIDS monitors network traffic for suspicious patterns in data packets, signatures of known network intrusions, to detect and remediate attacks and compromises. 

This is achieved through the use of a database of known intrusion types and data patterns, allowing signature-based NIDS to quickly identify intrusions and initiate the appropriate course of action. 

In contrast, anomaly-based NIDS use the baseline of the system in a normal state to track whether unusual or suspicious activity is occurring. This method takes time to set up, as baselining requires the NIDS to learn about your usage patterns, making it an organic, heuristic based approach to intrusion detection. 

The benefit of anomaly-based NIDS is that it is more flexible and powerful than signature-based NIDS that require an intrusion type is on file to pattern match against.

For example, a newly discovered intrusion type or vulnerability may not yet to be listed on CVE, making it hard for the signature-based NIDS to detect it. 

However, an anomaly-based NIDS could react immediately to the change in baseline.   

In general, it's suggested to employ a defense in depth strategy because both have their pros and cons.

Signature-based approaches are faster, generate less false positives and don't require time for baselining. However, they are reactive in nature and are completely exposed to new cyber threats. as they rely on a database of preexisting intrusion signatures.

While anomaly-based NIDS are difficult to set up, configure and train, they can be effective against new and existing attack vectors because of their ability to baseline a system at each protocol stack.

Signature-based and anomaly-based NIDS have complementary strengths and should be used together. 

What are the Top Free NIDS for Enterprise?

1. Snort: The leader in free open-sourceNIDS maintained by Cisco Systems. It's the most well-known open-source tool and is capable of running on Windows, Linux and Unix operating systems while analyzing real-time traffic. Snort has three modes: packet sniffer mode, packet logger and intrusion detection. The intrusion detection mode is based on a set of rules which you can create yourself or download from the Snort community. Snort is able to detect OS fingerprinting, port scanning, SMB probes and many other attacks by using signature-based and anomaly-based techniques. The two main downside of Snort is its lack of GUI (the community has introduced some) and the fact that creating rules can be complicated, leading to false positives. 
2. Suricata: A direct competitor to Snort that employs a signature-based, anomaly-based and policy driven intrusion detection methods. Snort provides real-time intrusion detection and prevention, as well as monitoring network security. For many, Suricata is a modern alternative to Snort with multi-threading capabilities, GPU acceleration and multiple model statistical anomaly detection. It's also compatible with Snort's data structure and you can implement Snort policies in Suricata. Suricata can examine TLS/SSL certificates, HTTP requests and DNS transactions.  
3. Zeek: formerly known as Bro, can run on Unix, Linux and Mac OS and follows two operations: traffic logging and analysis. Zeek differs from Snort as it also runs on the application layer, giving you the ability to track different services from different OSI layers such as HTTP, DNS, SNMP and FTP. Zeek uses signature-based and anomaly-based detection methods and has a diverse user community. 
4. OpenWIGS-ng: a free open-source NIDS dedicated to wireless networks, developed by the same team as well-known network intrusion tool Aircrack-ng. OpenWIGS-ng can be used as a Wi-Fi packet sniffer or for intrusion detection. The downside is it only works on linux systems. OpenWIGS-ng has three major components, a sensor to collect and send commands, a server that contains the analysis engine as well as an interface to display events and alerts.
5. Sguil: Sguil is a collection of components for network security monitoring. It can run on any operating system that supports tcl/tk. Once installed, analysts can receive alerts from Snort, Suricata, OSSEC, Zeek and other data sources.
6. Security Onion: an Ubuntu-based Linux distribution for IDS and network security monitoring (NSM), and consists of several of the above open-source technologies working in concert with each other. The platform offers comprehensive intrusion detection, network security monitoring, and log management by combining the best of Snort, Suricata, Zeek, as well as other tools such as Sguil, Squert, Snorby, ELSA, Xplico, among others others. For those desiring the best of the aforementioned tools in one single package, Security Onion is worth considering.

Securing the enterprise these days doesn’t need to be a bank-breaking ordeal. The aforementioned free open source NIDS solutions are all competent offerings that offer industrial strength protection against intrusions and compromises, with many of the tools complementing each other when used in tandem. Furthermore, offerings like Security Onion have taken the legwork out of picking/choosing the appropriate tools by combining the most popular open source security tools into one unified solution stack, freely available and easy to install.

What are the Limitations of NIDS?

• Noise can limit a NIDS effectiveness. Bad packets generated from bugs, corrupt DNS data and local packets can create a high false-alarm rate. 
• It's common for the number of real attacks to be far lower than the number of false-alarms. 
• Many attacks take advantage of vulnerabilities in outdated software, so a constant feed of new signatures is needed to mitigate threats.
• Signature-based NIDS have a delay between a new threat discovery and its signature being applied to the NIDS. During this time, the NIDS will be unable to identify the threat.  
• NIDS don't compensate for weak identification and authentication or weaknesses in network protocols.
• Encrypted packets aren't processed by most NIDS and can be used to allow intrusion to the network that is undiscovered until further intrusion has occurred.
• NIDS provides information based on network address associated with the IP packet that is sent into the network. As we know, IP attribution is not perfect and can be faked or scrambled.
• NIDS are susceptible to protocol-based attacks and invalid data and TCP/IP stack attacks can cause NIDS to crash.