From: Stefano Zanero (zaneroelet.polimi.it)
Date: Sat Sep 01 2007 - 07:30:17 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Surya Batchu wrote:
> Hi,
>
> Karalon Traffic IQ Pro can be used to test attack/exploit detection
> capabilities of IDS/IPS systems. I am interested in knowing SNORT
> IDS detection capabilities and its coverage when Traffic IQ Pro
> system is used.

Since Snort is (substantially) a misuse-based system, a detection rate
figure will tell you nothing (or close-to-nothing) useful about it.

Detection Rate and False Positive Rate are a good way to score anomaly
detectors, but are not useful to score misuse detectors.

Stefano

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]