145 reputation
6
bio website imdb.com/name/nm0446382
location Princeton, NJ
age 26
visits member for 2 years, 9 months
seen Dec 26 '12 at 5:28
student

Dec
3
awarded  Teacher
Dec
3
awarded  Scholar
Dec
3
awarded  Editor
Dec
3
accepted Logging True/False Negatives on Snort
Dec
3
revised Logging True/False Negatives on Snort
Added one of the comments into the answer so that I could accept the answer as correct.
Dec
3
awarded  Supporter
Dec
3
suggested suggested edit on Logging True/False Negatives on Snort
Dec
3
comment Logging True/False Negatives on Snort
Thanks. That's exactly what I've been doing (using different units for each). Thanks for your comments. I've been using another sensor as well, which worked as a binary classifier, so I was able to have a more specific look at true/false negatives.
Dec
2
answered Is there a cyber equivalent to the JTLS?
Dec
2
awarded  Student
Dec
2
awarded  Autobiographer
Dec
2
comment Logging True/False Negatives on Snort
I do have ground truth since I am the one running the attacks. Unfortunately 1 missed attack is not equivalent to 1 false negative when I'm focusing on Alerts. To help clarify, if I have 10 attacks run on my network, there could be 300 Snort alerts. Of these 300, 250 could be True Positives, while 50 are False Positives, because there is not a one-to-one relationship between alerts and attacks. I'm trying to get this same data for negatives. Thanks for the help.
Nov
23
asked Logging True/False Negatives on Snort