Can Machine Learning Improve Snort's Detection?

Abstract

Signature-based Intrusion Detection Systems such as Snort are widely deployed due to their transparency, but their dependence on manually crafted rules creates persistent blind spots against attack categories not covered by existing signatures. This paper investigates whether machine learning can meaningfully improve Snort's detection capability without replacing its rule-based architecture. Using the CICIDS2017 dataset, we evaluated Snort 3 in three configurations: default built-in rules, community rules, and a hybrid configuration in which rules are derived from a flow level SD-RNN classifier trained on CICIDS2017 features. The SD-RNN model is independently re-implemented and trained in this work, achieving 97.14% overall accuracy with a macro recall of 0.93 across 15 attack classes. Our experiments show that Snort's built-in rules detect only 30.27% of attack flows overall, with complete failure on FTP-Patator, PortScan, Bot, SQL Injection, and Infiltration. The community rules provide negligible additional coverage. ML-derived rules raise the overall detection rate to 58.36%, covering 9 of 14 attack classes above 80% detection, including 100% detection for brute-force and web application attacks that signature-only configurations miss entirely. We present a complete evaluation methodology and a reproducible flow level framework for aligning Snort's packet-level alerts with flow level ground truth, which can serve as a baseline for future work on ML-enhanced signature-based IDS.