Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation
Top Cited Papers
- 7 November 2002
- proceedings article
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- Vol. 2, 12-26
- https://doi.org/10.1109/discex.2000.821506
Abstract
A intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100's of users on 1000's of hosts. More than 300 instances of 38 different automated attacks were launched against victim UNIX hosts in seven weeks of training data and two weeks of test data. Six research groups participated in a blind evaluation and results were analyzed for probe, denial- of-service (DoS), remote-to-local (R2L), and user to root (U2R) attacks. The best systems detected old attacks included in the training data, at moderate detection rates ranging from 63% to 93% at a false alarm rate of 10 false alarms per day. Detection rates were much worse for new and novel R2L and DoS attacks included only in the test data. The best systems failed to detect roughly half these new attacks which included damaging access to root-level privileges by remote users. These results suggest that further research should focus on developing techniques to find new attacks instead of extending existing rule-based approaches.Keywords
This publication has 10 references indexed in Scilit:
- NetSTAT: a network-based intrusion detection approachPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Execution monitoring of security-critical programs in distributed systems: a specification-based approachPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- A data mining analysis of RTID alarmsComputer Networks, 2000
- Mining in a data-flow environmentPublished by Association for Computing Machinery (ACM) ,1999
- Testing and evaluating computer intrusion detection systemsCommunications of the ACM, 1999
- The threat from the net [Internet security]IEEE Spectrum, 1997
- Coronary Artery Bypass Risk Prediction Using Neural NetworksThe Annals of Thoracic Surgery, 1997
- A methodology for testing intrusion detection systemsIEEE Transactions on Software Engineering, 1996
- An Introduction to the BootstrapPublished by Springer Nature ,1993
- The Relative Operating Characteristic in PsychologyScience, 1973