Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
6
Newest
 Teacher
Impact
~749 people reached

Dec
3
awarded  Teacher
Dec
3
awarded  Scholar
Dec
3
awarded  Editor
Dec
3
accepted Logging True/False Negatives on Snort
Dec
3
revised Logging True/False Negatives on Snort
Added one of the comments into the answer so that I could accept the answer as correct.
Dec
3
awarded  Supporter
Dec
3
suggested approved edit on Logging True/False Negatives on Snort
Dec
3
comment Logging True/False Negatives on Snort
Thanks. That's exactly what I've been doing (using different units for each). Thanks for your comments. I've been using another sensor as well, which worked as a binary classifier, so I was able to have a more specific look at true/false negatives.
Dec
2
answered Is there a cyber equivalent to the JTLS?
Dec
2
awarded  Student
Dec
2
awarded  Autobiographer
Dec
2
comment Logging True/False Negatives on Snort
I do have ground truth since I am the one running the attacks. Unfortunately 1 missed attack is not equivalent to 1 false negative when I'm focusing on Alerts. To help clarify, if I have 10 attacks run on my network, there could be 300 Snort alerts. Of these 300, 250 could be True Positives, while 50 are False Positives, because there is not a one-to-one relationship between alerts and attacks. I'm trying to get this same data for negatives. Thanks for the help.
Nov
23
asked Logging True/False Negatives on Snort