Re: IPS false negatives

[Stefano Zanero <zanero () elet polimi it>]

Basgen, Brian wrote:
>  Is anyone aware of research that has been done to qualify/quantify the
> false negatives that commercial IPS's will pass when running on a
> default configuration?

You cannot meaningfully quantify "false negatives" of a misuse-based
system (IPS or IDS), because that quantity depends on the type of attack
mix you use for testing.

On the other hand, you can quantify true positives to false positives
ratio (signal2noise) on anomaly detection systems in a meaningful way.

Stefano

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------