IDS mailing list archives
Re: IPS false negatives
From: Stefano Zanero <zanero () elet polimi it>
Date: Fri, 14 Apr 2006 11:21:26 +0200
Basgen, Brian wrote:
Is anyone aware of research that has been done to qualify/quantify the false negatives that commercial IPS's will pass when running on a default configuration?
You cannot meaningfully quantify "false negatives" of a misuse-based system (IPS or IDS), because that quantity depends on the type of attack mix you use for testing. On the other hand, you can quantify true positives to false positives ratio (signal2noise) on anomaly detection systems in a meaningful way. Stefano ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- IPS false negatives Basgen, Brian (Apr 13)
- Re: IPS false negatives Stefano Zanero (Apr 15)
- Re: IPS false negatives Thomas Choi (Apr 17)
- Re: IPS false negatives Thomas Ptacek (Apr 18)
- Re: IPS false negatives Thomas Choi (Apr 18)
- Re: IPS false negatives Thomas Ptacek (Apr 18)
- <Possible follow-ups>
- RE: IPS false negatives Biswas, Proneet (Apr 15)