Towards a Lightweight Intrusion Detection Framework for Resource-Constrained Home Networks: Design, Implementation and Experimental Evaluation

The recent technological growth, affordable computing devices and the lack of user expertise have contributed to an increased level of cybersecurity attacks for home networks. Although Network Intrusion Detection System (NIDS) are very effective to detect malicious activities, most existing solutions are designed primarily for enterprise environments requiring high computational resources and skilled manual configuration. These requirements restrict their use in home network environments. This paper hypothesises that a lightweight IDS can improve the security for home networks significantly and presents a design, implementation and evaluation of a Snort 3-based IDS framework. It combines a customised ruleset to detect the most prevalent threats i.e. Denial of Service (DoS), Brute Force, reconnaissance, phishing and malware, develops a representative home network traffic model, an automated testing methodology and a GUI-based tool to create Snort 3 rules to aid the non-expert users. The framework is evaluated using Virtual and Hybrid architectures with a virtual and physical Raspberry Pi, respectively, as the resource-constrained device. The experimental results demonstrate that the proposed framework achieves high detection performance i.e. an average precision of over 0.99, an average recall of over 0.83 and an average F1-score of over 0.90 while maintaining low computational resource utilisation.