{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T13:16:45Z","timestamp":1774444605564,"version":"3.50.1"},"reference-count":27,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2022,2,7]],"date-time":"2022-02-07T00:00:00Z","timestamp":1644192000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"the first author Acknowledgments: This publication is supported by Direktorat Riset dan Pengembangan, Universitas Indonesia","award":["NKB-1680\/UN2.RST\/HKP.05.00\/2020"],"award-info":[{"award-number":["NKB-1680\/UN2.RST\/HKP.05.00\/2020"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["BDCC"],"abstract":"<jats:p>Snort is a well-known, signature-based network intrusion detection system (NIDS). The Snort sensor must be placed within the same physical network, and the defense centers in the typical NIDS architecture offer limited network coverage, especially for remote networks with a restricted bandwidth and network policy. Additionally, the growing number of sensor instances, followed by a quick increase in log data volume, has caused the present system to face big data challenges. This research paper proposes a novel design for a cloud-based Snort NIDS using containers and implementing big data in the defense center to overcome these problems. Our design consists of Docker as the sensor\u2019s platform, Apache Kafka, as the distributed messaging system, and big data technology orchestrated on lambda architecture. We conducted experiments to measure sensor deployment, optimum message delivery from the sensors to the defense center, aggregation speed, and efficiency in the data-processing performance of the defense center. We successfully developed a cloud-based Snort NIDS and found the optimum method for message-delivery from the sensor to the defense center. We also succeeded in developing the dashboard and attack maps to display the attack statistics and visualize the attacks. Our first design is reported to implement the big data architecture, namely, lambda architecture, as the defense center and utilize rapid deployment of Snort NIDS using Docker technology as the network security monitoring platform.<\/jats:p>","DOI":"10.3390\/bdcc6010019","type":"journal-article","created":{"date-parts":[[2022,2,7]],"date-time":"2022-02-07T08:38:48Z","timestamp":1644223128000},"page":"19","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["The Next-Generation NIDS Platform: Cloud-Based Snort NIDS Using Containers and Big Data"],"prefix":"10.3390","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0550-1608","authenticated-orcid":false,"given":"Ferry Astika","family":"Saputra","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering, Faculty of Engineering, Kampus UI Depok, Universitas Indonesia, Depok 16424, Indonesia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Muhammad","family":"Salman","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, Faculty of Engineering, Kampus UI Depok, Universitas Indonesia, Depok 16424, Indonesia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2713-0919","authenticated-orcid":false,"given":"Jauari Akhmad Nur","family":"Hasim","sequence":"additional","affiliation":[{"name":"Department of Informatics and Computer Engineering, Kampus Sukolilo, Politeknik Elektronika Negeri Surabaya, Surabaya 60111, Indonesia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Isbat Uzzin","family":"Nadhori","sequence":"additional","affiliation":[{"name":"Department of Informatics and Computer Engineering, Kampus Sukolilo, Politeknik Elektronika Negeri Surabaya, Surabaya 60111, Indonesia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0374-4465","authenticated-orcid":false,"given":"Kalamullah","family":"Ramli","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, Faculty of Engineering, Kampus UI Depok, Universitas Indonesia, Depok 16424, Indonesia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,2,7]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Karim, I., Vien, Q.-T., Le, T., and Mapp, G. (2017). A Comparative Experimental Design and Performance Analysis of Snort-Based Intrusion Detection System in Practical Computer Networks. Computers, 6.","DOI":"10.3390\/computers6010006"},{"key":"ref_2","unstructured":"Irdoni, S., Saputra, F.A., and Ahsan, A.S. (2017). Optimizing the Database of Mata Garuda by Using Partition Table, Politeknik Elektronika Negeri Surabaya."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"83","DOI":"10.24003\/emitter.v7i1.340","article-title":"Spatio Temporal with Scalable Automatic Bisecting-Kmeans for Network Security Analysis in Matagaruda Project","volume":"7","author":"Hisyam","year":"2019","journal-title":"Emit. Int. J. Eng. Technol."},{"key":"ref_4","unstructured":"Hisyam, M., Saputra, F.A., and Akhmad, J. (2015). A Study of Implementing Data Mining Using Hadoop and Mahout for Mata Garuda Log Analysis, Politeknik Elektronika Negeri Surabaya."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Xing, J., Zhou, H., Shen, J., Zhu, K., Wang, Y., Wu, C., and Ruan, W. (2018, January 26\u201328). AsIDPS: Auto-Scaling Intrusion Detection and Prevention System for Cloud. Proceedings of the 2018 25th International Conference on Telecommunications, ICT 2018, Saint-Malo, France.","DOI":"10.1109\/ICT.2018.8464855"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"824","DOI":"10.1016\/j.procs.2016.07.238","article-title":"A Framework for Fast and Efficient Cyber Security Network Intrusion Detection Using Apache Spark","volume":"93","author":"Gupta","year":"2016","journal-title":"Procedia Comput. Sci."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"473","DOI":"10.1016\/j.future.2018.09.051","article-title":"BigFlow: Real-time and reliable anomaly-based intrusion detection for high-speed networks","volume":"93","author":"Viegas","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Liu, H., and Lang, B. (2019). Machine learning and deep learning methods for intrusion detection systems: A survey. Appl. Sci., 9.","DOI":"10.3390\/app9204396"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Carta, S., Podda, A.S., Recupero, D.R., and Saia, R. (2020). A local feature engineering strategy to improve network anomaly detection. Future Internet, 12.","DOI":"10.3390\/fi12100177"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"34","DOI":"10.1186\/s40537-018-0145-4","article-title":"Intrusion detection model using machine learning algorithm on Big Data environment","volume":"5","author":"Othman","year":"2018","journal-title":"J. Big Data"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1845","DOI":"10.1109\/TPDS.2020.2978480","article-title":"Evaluation of Stream Processing Frameworks","volume":"31","year":"2020","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"11897","DOI":"10.1109\/ACCESS.2018.2810267","article-title":"Clustering Approach Based on Mini Batch Kmeans for Intrusion Detection System over Big Data","volume":"6","author":"Peng","year":"2018","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Hafsa, M., and Jemili, F. (2018). Comparative Study between Big Data Analysis Techniques in Intrusion Detection. Big Data Cogn. Comput., 3.","DOI":"10.3390\/bdcc3010001"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.jss.2019.01.051","article-title":"The Journal of Systems and Software Architectural Tactics for Big Data Cybersecurity Analytics Systems: A Review","volume":"151","author":"Ullah","year":"2019","journal-title":"J. Syst. Softw."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"70","DOI":"10.1145\/2627534.2627557","article-title":"Big data classification. ACM SIGMETRICS Perform","volume":"41","author":"Suthaharan","year":"2014","journal-title":"Eval. Rev."},{"key":"ref_16","unstructured":"Renae Gregoire, J.S. (2015). Big Data: Principles and Best Practices of Scalable Realtime Data Systems, Manning. [1st ed.]."},{"key":"ref_17","unstructured":"(2021, January 12). Docker. Get Started with Docker. Available online: https:\/\/www.docker.com\/get-started."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"70245","DOI":"10.1109\/ACCESS.2020.2986882","article-title":"AI-IDS: Application of Deep Learning to Real-Time Web Intrusion Detection","volume":"8","author":"Kim","year":"2020","journal-title":"IEEE Access"},{"key":"ref_19","unstructured":"(2021, December 27). Alpine Linux. Available online: https:\/\/www.alpinelinux.org\/."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1016\/j.procs.2018.05.169","article-title":"Network Intrusion Detection in Big Dataset Using Spark","volume":"132","author":"Dahiya","year":"2018","journal-title":"Procedia Comput. Sci."},{"key":"ref_21","unstructured":"Proffitt, T. (2021, January 22). How Can You Build and Leverage SNORT IDS Metrics to Reduce Risk. Available online: https:\/\/www.sans.org\/white-papers\/34350\/."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"7","DOI":"10.1186\/1687-417X-2013-7","article-title":"A quality metric for IDS signatures: In the wild the size matters","volume":"2013","author":"Raftopoulos","year":"2013","journal-title":"Eurasip J. Inf. Secur."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Masoudi-Sobhanzadeh, Y., Motieghader, H., and Masoudi-Nejad, A. (2019). FeatureSelect: A software for feature selection based on machine learning approaches. BMC Bioinform., 20.","DOI":"10.1186\/s12859-019-2754-0"},{"key":"ref_24","unstructured":"(2022, January 18). Suricata. Available online: https:\/\/suricata.io\/."},{"key":"ref_25","unstructured":"(2022, January 18). The Zeek Network Security Monitor. Available online: https:\/\/zeek.org\/."},{"key":"ref_26","unstructured":"(2022, January 22). The ELK Stack: From the Creators of Elasticsearch. Available online: https:\/\/www.elastic.co\/what-is\/elk-stack."},{"key":"ref_27","unstructured":"(2022, January 22). Grafana: The Open Observability Platform. Available online: https:\/\/grafana.com\/."}],"container-title":["Big Data and Cognitive Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-2289\/6\/1\/19\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:15:28Z","timestamp":1760134528000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-2289\/6\/1\/19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,7]]},"references-count":27,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,3]]}},"alternative-id":["bdcc6010019"],"URL":"https:\/\/doi.org\/10.3390\/bdcc6010019","relation":{},"ISSN":["2504-2289"],"issn-type":[{"value":"2504-2289","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,7]]}}}