BICEP
Benchmarking IDS in a Comparative Evaluation Platform
Aims & Objectives
BICEP stands for Benchmarking IDS in a Comparative Evaluation Platform. It is a framework, designed to establish cross-study comparability by setting up, configuring, ensembling and benchmarking arbitrary IDS solutions under common circumstances. Currently we support Suricata, Snort and Slips as IDS to benchmark using PCAP datasets with CSV file labels. However, the platform is designed to be adaptable; thus, new IDS and dataset types can be added seemlessly.
Research topics
Adding Support for collaborative IDS
Distributed IDS solutions are an integral part for cyberdefense with special deployment and benchmarking needs. Therefor the framework needs adaptation and integration of CIDS solutions. Additionally, these IDS ought to be benchmarked against standalone solutions.
ML classifier creation and benchmarking
Machine learning based IDS are scarce and often offer subpar runtime performance. Thus, creating lightweight ML classifiers and benchmarking them against other solutions to find optimal detection methods is part of our research.
Funding
-
People from the EMCL
Partners
-
Contact
Links
Publications
- M. Ludwig, S. Machmeier, V. Heuveline, "Cross-Study Comparability for IDS: A Call for Clarity ", in 2025 9th Cyber Security in Networking Conference (CSNet), Abu Dhabi, VAE, 2025.
