Re: IDS Signature Confidence

["David W. Goodrum" <dgoodrum () nfr com>]

Hi Raffael,

at NFR we've recognized this, and with every alert we assign a 
"confidence index" to the alert.  The index is a percentage of how 
"real" we think the attack is.   In some cases, the index will be very 
high (for things that are known and can be mapped to a CVE or CAN), and 
for others it will be lower (some violation of a protocol anomaly), and 
for others it will be dynamic, depending on how much data we have.  DoS 
attacks are typical of attacks where the more data you have, the higher 
the confidence might be.

-dave

--
David W. Goodrum, CEH
Senior Systems Engineer
(nfr)(security)
http://www.nfr.com

See NFR Security at these upcoming events:

Security Ventures 2005, July 13, New York, NY


Raffael Marty wrote:

> I was thinking about this following problem: Assume you have an NIDS
> signature looking for DoS attacks. In most of the cases I don't trust the
> NIDS reporting on a DoS attack. A lot of the DoS sigs just look at
> some bytes on the wire and tell me that there is a DoS attack going
> on. However, I need some more evidence that my services are indeed not
> accessible anymore.  Some signatures on the other hand are very specific
> and you can trust them with whatever they report.
> Now this brings me to my question:  How do you guys decide how much
> confidence you put in a certain IDS signature? And I am not talking
> about prioritizing the event. I am talking about assigning a "success"
> or "possible success" to signatures.
>
>  -raffy
>
>
> --
>  Raffael Marty, GCIA, CISSP                     raffael.marty () arcsight com
>  Senior Security Engineer                     Content Team @ ArcSight Inc.
>  5 Results Way             Cupertino, CA 95014              (408) 864-2662
>
> --------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------------------
>
>  


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------