Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at every network record) . I read about the ICSA labs certification for Snort here http://lwn.net/Articles/6896/ but, it does not talk about false positive/ negative rates.
2
-
Define false positive. If it's a real attack for a server you don't run, is that a valid alert?– u2702Jan 14, 2014 at 20:16
-
Personally, it is better to have more false positives than stop no attacks. IDS should never block legitimate access to a system, that is a very fine line - as I am sure you know.– KingJohnnoJan 14, 2014 at 22:06
Add a comment
|
1 Answer
False positives are a tricky issue. They deepening on your setup, the rules you use, and the IDS configuration. Generic industry numbers will not apply to your network.
If you just want stats try NSS Labs, http://www.nsslabs.com. They do competitive testing for all types of security products and false positive rate is one of the metrics they use heavily.
