Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at every network record) . I read about the ICSA labs certification for Snort here http://lwn.net/Articles/6896/ but, it does not talk about false positive/ negative rates.

  • Define false positive. If it's a real attack for a server you don't run, is that a valid alert? – u2702 Jan 14 '14 at 20:16
  • Personally, it is better to have more false positives than stop no attacks. IDS should never block legitimate access to a system, that is a very fine line - as I am sure you know. – KingJohnno Jan 14 '14 at 22:06

False positives are a tricky issue. They deepening on your setup, the rules you use, and the IDS configuration. Generic industry numbers will not apply to your network.

If you just want stats try NSS Labs, http://www.nsslabs.com. They do competitive testing for all types of security products and false positive rate is one of the metrics they use heavily.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.