Towards a lightweight intrusion detection framework for resource-constrained home networks: design, implementation and experimental evaluation

The recent technological growth, affordable computing devices and a lack of user expertise have contributed to an increased level of cybersecurity attacks for home networks. Although Network Intrusion Detection Systems (NIDS) are very effective in detecting malicious activities, most existing solutions are designed primarily for enterprise environments requiring high computational resources and skilled manual configuration. These requirements restrict their use in home network environments. This paper hypothesises that a lightweight IDS can significantly improve the security of home networks and presents a design, implementation and evaluation of a Snort 3-based IDS framework. It combines a customised ruleset to detect the most prevalent threats, i.e. Denial of Service (DoS), Brute Force, reconnaissance, phishing and malware, and develops a representative home network traffic model, an automated testing methodology and a GUI-based tool to create Snort 3 rules to aid the non-expert users. The framework is evaluated using Virtual and Hybrid architectures with a virtual and physical Raspberry Pi, respectively, as the resource-constrained device. The experimental results demonstrate that the proposed framework achieves high detection performance, i.e. an average precision of over 0.99, an average recall of over 0.83 and an average F1-score of over 0.90, while maintaining low computational resource utilisation.