Automatic Evaluation of Intrusion Detection Systems

Frederic Massicotte; Francois Gagnon; Yvan Labiche; Lionel Briand; Mathieu
Couture 

Computer Security Applications Conference, 2006. ACSAC '06. 22nd Annual,
Dec. 2006

Pages:361-370

Abstract: An intrusion detection system (IDS) is a crucial element of a
network security posture. Although there are many IDS products available, it
is rather difficult to find information about their accuracy. Only a few
organizations evaluate these products. Furthermore, the data used to test
and evaluate these IDS is usually proprietary. Thus, the research community
cannot easily evaluate the next generation of IDS. Toward this end, DARPA
provided in 1998, 1999 and 2000 an intrusion detection evaluation data set.
However, no new data set has been released by DARPA since 2000, in part
because of the cumbersomeness of the task. In this paper, we propose a
strategy to address certain aspects of generating a publicly available
documented data set for testing and evaluating intrusion detection systems.
We also present a tool that automatically analyzes and evaluates IDS using
our proposed data set.

URL:
http://ieeexplore.ieee.org.ezproxy.auckland.ac.nz/iel5/4041138/4041139/04041
181.pdf?isnumber=4041139&prod=STD&arnumber=4041181&arnumber=4041181&arSt=361
&ared=370&arAuthor=Frederic+Massicotte%3B+Francois+Gagnon%3B+Yvan+Labiche%3B
+Lionel+Briand%3B+Mathieu+Couture