| Sumario: | Intrusion detection system (IDS) are essential for safeguarding organizational resources; however, their practical deployment is often hindered by alert fatigue and the need for extensive rule configuration and tuning, which can reduce detection efficiency. YARA is a pattern-matching tool for detecting malware and intrusions indicators in cybersecurity contexts. This study investigates the integration of Suricata, an open-source IDS, with YARA to enhance intrusion detection performance. The implementation was conducted in a virtual environment and the integrated system was tested using live network traffic captured using Wireshark, a network monitoring tool. The results show that there is 20% reduction in the total number of alerts following the integration of Suricata and YARA rules, indicating a decrease in redundant or false alerts. These findings provide empirical evidence that IDS performance is strongly influenced by rule configuration and tuning strategies. The observed reduction in alerts confirms that YARA-based customization can improve IDS efficiency and mitigate alert-fatigue. The study highlights the potential of YARA--Suricata integration is an effective fine-tuning strategy and underscores its relevance for future research on automated rule optimization, false-positive reduction methods, and adaptive intrusion detection systems aimed at strengthening real-world cybersecurity operations.
|
|---|