Re: False Positives

["MARTIN M. Bénoni" <benoni_martin () hotmail com>]

hello!

I prefer saying first that I aml not really an expert in that field. However 
I participated to a project where the goal was to set up an anti-intrusion 
"belt". There I compared Snort and NFR and finally started deplying this 
belt.

I have been working with people with good technical skills, but I do not 
heard about a "magic" way to avoid false positives. What I did under their 
supervision was to set up two machines with the same NIDS on each, one was 
the reference to see allm the alerts, the other was tuned when seeing the 
alerts...So, much time spent on tunning the IDS, and, according to wht I 
have heard, it is the longer part of he job!

Sorry I cannot provide a magic solution! :)

-BĂ©noni


> From: Andi Hess <andi_hess () web de>
> To: focus-ids () securityfocus com
> Subject: False Positives
> Date: 3 Jun 2003 16:13:11 -0000
>
>
>
> Hi there,
>
> I am new in the field of NIDS and I wonder if the
> problem of false positives is really this huge as
> mentioned in several publications.
>
> I am considering tools like PCP, Stick (I have never
> seen them, but read about them) which can be used to
> generate huge amount of packets and each on triggers an
> alarm on the victim IDS (a false positive, as the
> packets are not a real attack).
> As it has been impossible for me to find any of the
> above mentioned packet generators - I wonder how the
> packets look like?
> Is it possible to differentiate 'artifically' generated
> false positives from natural ones?
>
> Any hint is welcome!
>
> Thank you.
>
> A.
>
>
>
>
> -------------------------------------------------------------------------------
> INTRUSION PREVENTION: READY FOR PRIME TIME?
>
> IntruShield now offers unprecedented Intrusion IntelligenceTM capabilities
> - including intrusion identification, relevancy, direction, impact and 
> analysis
> - enabling a path to prevention.
>
> Download the latest white paper "Intrusion Prevention: Myths, Challenges, 
> and Requirements" at:
> http://www.securityfocus.com/IntruVert-focus-ids2
> -------------------------------------------------------------------------------

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963


-------------------------------------------------------------------------------
INTRUSION PREVENTION: READY FOR PRIME TIME?

IntruShield now offers unprecedented Intrusion IntelligenceTM capabilities 
- including intrusion identification, relevancy, direction, impact and analysis 
- enabling a path to prevention.

Download the latest white paper "Intrusion Prevention: Myths, Challenges, and Requirements" at: 
http://www.securityfocus.com/IntruVert-focus-ids2
-------------------------------------------------------------------------------