I'm using Snort in a lab environmnet with artificially generated traffic.
I'm looking to build a confusion matrix from known generated attacks.
True Positives and False Positives are easy to parse out of the alerts file, but I'm looking for a way to quantify True/False Negatives.
These would be instances in which Snort could have alerted, but didn't.
I'm not sure how closely related this is to number of packets, because I'm not sure if Snort could potentially alert multiple times per packet.
Any help is appreciated.