POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering

Koen T.W. Teuwen; Emmanuele Zambon; Luca Allodi

doi:10.1145/3708821.3735349

POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

32 Downloads (Pure)

Abstract

Organizations deploy Intrusion Detection Systems (IDSs) like Suricata to defend against threats. Although rulesets, rules, and the resulting alerts have been studied previously, little is known about the process by which rules are engineered thus far. We aim to address the previously mentioned gaps by studying how network intrusion detection rules are derived from incidents. To this end, we propose the SuriCap measurement platform and organize Jeopardy-style workshops in which participants compete to engineer Suricata rules. We collect a rich dataset consisting of over 364 rules from 28 participants. Preliminary results suggest our experimental design is viable and, together with the SuriCap measurement platform, can enable us to answer several research questions surrounding the engineering process of network intrusion detection rules.

Original language	English
Title of host publication	ASIA CCS '25
Subtitle of host publication	Proceedings of the 20th ACM ASIA Conference on Computer and Communications Security
Publisher	Association for Computing Machinery, Inc.
Pages	1818-1820
Number of pages	3
ISBN (Electronic)	979-8-4007-1410-8
DOIs	https://doi.org/10.1145/3708821.3735349
Publication status	Published - 24 Aug 2025
Event	20th ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2025 - Hanoi, Viet Nam Duration: 25 Aug 2025 → 29 Aug 2025

Conference

Conference	20th ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2025
Country/Territory	Viet Nam
City	Hanoi
Period	25/08/25 → 29/08/25

Bibliographical note

Publisher Copyright:
© 2025 Copyright held by the owner/author(s).

Keywords

Network Intrusion Detection Rules
Network Intrusion Detection System (NIDS)
Security Operations Center (SOC)

Access to Document

10.1145/3708821.3735349

pdfFinal published version, 614 KBLicence: TAVERNE

Cite this

@inproceedings{2bfda5474ba44104a3c65fc44ebbe2a7,

title = "POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering",

abstract = "Organizations deploy Intrusion Detection Systems (IDSs) like Suricata to defend against threats. Although rulesets, rules, and the resulting alerts have been studied previously, little is known about the process by which rules are engineered thus far. We aim to address the previously mentioned gaps by studying how network intrusion detection rules are derived from incidents. To this end, we propose the SuriCap measurement platform and organize Jeopardy-style workshops in which participants compete to engineer Suricata rules. We collect a rich dataset consisting of over 364 rules from 28 participants. Preliminary results suggest our experimental design is viable and, together with the SuriCap measurement platform, can enable us to answer several research questions surrounding the engineering process of network intrusion detection rules.",

keywords = "Network Intrusion Detection Rules, Network Intrusion Detection System (NIDS), Security Operations Center (SOC)",

author = "Teuwen, \{Koen T.W.\} and Emmanuele Zambon and Luca Allodi",

note = "Publisher Copyright: {\textcopyright} 2025 Copyright held by the owner/author(s).; 20th ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2025 ; Conference date: 25-08-2025 Through 29-08-2025",

year = "2025",

month = aug,

day = "24",

doi = "10.1145/3708821.3735349",

language = "English",

pages = "1818--1820",

booktitle = "ASIA CCS '25",

publisher = "Association for Computing Machinery, Inc.",

address = "United States",

}

Teuwen, KTW , Zambon, E & Allodi, L 2025, POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering. in ASIA CCS '25: Proceedings of the 20th ACM ASIA Conference on Computer and Communications Security. Association for Computing Machinery, Inc., pp. 1818-1820, 20th ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2025, Hanoi, Viet Nam, 25/08/25. https://doi.org/10.1145/3708821.3735349

POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering. / Teuwen, Koen T.W.; Zambon, Emmanuele ; Allodi, Luca.
ASIA CCS '25: Proceedings of the 20th ACM ASIA Conference on Computer and Communications Security. Association for Computing Machinery, Inc., 2025. p. 1818-1820.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering

AU - Teuwen, Koen T.W.

AU - Zambon, Emmanuele

AU - Allodi, Luca

PY - 2025/8/24

Y1 - 2025/8/24

N2 - Organizations deploy Intrusion Detection Systems (IDSs) like Suricata to defend against threats. Although rulesets, rules, and the resulting alerts have been studied previously, little is known about the process by which rules are engineered thus far. We aim to address the previously mentioned gaps by studying how network intrusion detection rules are derived from incidents. To this end, we propose the SuriCap measurement platform and organize Jeopardy-style workshops in which participants compete to engineer Suricata rules. We collect a rich dataset consisting of over 364 rules from 28 participants. Preliminary results suggest our experimental design is viable and, together with the SuriCap measurement platform, can enable us to answer several research questions surrounding the engineering process of network intrusion detection rules.

AB - Organizations deploy Intrusion Detection Systems (IDSs) like Suricata to defend against threats. Although rulesets, rules, and the resulting alerts have been studied previously, little is known about the process by which rules are engineered thus far. We aim to address the previously mentioned gaps by studying how network intrusion detection rules are derived from incidents. To this end, we propose the SuriCap measurement platform and organize Jeopardy-style workshops in which participants compete to engineer Suricata rules. We collect a rich dataset consisting of over 364 rules from 28 participants. Preliminary results suggest our experimental design is viable and, together with the SuriCap measurement platform, can enable us to answer several research questions surrounding the engineering process of network intrusion detection rules.

KW - Network Intrusion Detection Rules

KW - Network Intrusion Detection System (NIDS)

KW - Security Operations Center (SOC)

UR - https://www.scopus.com/pages/publications/105015986858

U2 - 10.1145/3708821.3735349

DO - 10.1145/3708821.3735349

M3 - Conference contribution

AN - SCOPUS:105015986858

SP - 1818

EP - 1820

BT - ASIA CCS '25

PB - Association for Computing Machinery, Inc.

T2 - 20th ACM ASIA Conference on Computer and Communications Security, ASIA CCS 2025

Y2 - 25 August 2025 through 29 August 2025

ER -

POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering

Abstract

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this