From: Stefano Zanero (zaneroelet.polimi.it)
Date: Thu May 22 2008 - 15:07:43 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Christian Bockermann wrote:

> wang: You might have want to have a look at the paper "Anomaly
> Detection of Web-based Attacks" by Giovanni Vigna and Christopher
> Kruegel (as well as "A multi-model approach to the detection of
> web-based attacks" by them).
> They did log file analysis on access log data using statistical models.
> This might work for you as a labeling approach.

Using an anomaly detector (with its false positives and negatives) to
label a dataset to evaluate another anomaly detector is the biblical
"blind leading the blind" ;)

Stefano

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]