Snort mailing list archives
A New White Paper - Baseline Analysis of Security Data
From: "Orit Vidas" <orit () securimine com>
Date: Tue, 25 Jan 2005 15:07:30 -0800
Hello, A new white paper has been released by the Securimine Team. To download the white paper, go to http://www.securimine.com/product.html Title: Baseline Analysis of Security Data Abstract: Regardless of the development in the SIM (Security Information Management) area, there is still a huge problem with existing detection tools. Although these tools detect all the intrusions, they detect much more than that. This problem, known as false positives, is a big barrier for intrusion detection tools to cross before their deployment can be practical. To date, intrusion detection vendors, or more precisely security experts, are struggling with an inherent conflict and are sometimes forced to write less adequate detection rules just to reduce the number of false positives. In this paper we suggest a different approach for using data mining technology in the intrusion detection area. We claim that the best positioning for a data mining technology within an intrusion detection system is not as a detection engine, but rather as an analysis layer that will filter out the false positives. The ability of data mining technology to build behavioral models representing 'normal' behavior of data is most suitable to model the data generated by the intrusion detection engines. Best regards, The Securimine Team www.securimine.com <http://www.securimine.com/>
Current thread:
- A New White Paper - Baseline Analysis of Security Data Orit Vidas (Jan 25)