Enhancing Cyber Attack Detection: An Analysis of Security Onion for Small and Midsize Enterprise
Gaurav Bhatia, Ghada Almukhaini · 2024
With the advancement of technology, cyber-attacks are becoming more frequent than ever before. When a sophisticated attack occurs, organization business suffers adversely. Small and Midsize Enterprise (SME) operate with limited resources in terms of staff and budgets. Most SME does not have capabilities to detect advanced threats on their network and attackers can easily target them. Our research objective is to test free and open-source software that fulfills the security demands of SME. Security Onion is a Linux distribution designed for intrusion detection, threat hunting, security monitoring, and log management solution. In this research, we have created a proof-of-concept prototype using a single node setup of test lab to evaluate the effectiveness of Security Onion by simulating various cyber-attacks on the different services running into the network. The performance of Security Onion is analyzed by its alert’s generation and detection capabilities. Based on our experimental results we found that Security Onion can effectively provide the required protection to the SME.