Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at every network record) . I read about the ICSA labs certification for Snort here http://lwn.net/Articles/6896/ but, it does not talk about false positive/ negative rates.

  • Define false positive. If it's a real attack for a server you don't run, is that a valid alert?
    – u2702
    Commented Jan 14, 2014 at 20:16
  • Personally, it is better to have more false positives than stop no attacks. IDS should never block legitimate access to a system, that is a very fine line - as I am sure you know.
    – KingJohnno
    Commented Jan 14, 2014 at 22:06

1 Answer 1


False positives are a tricky issue. They deepening on your setup, the rules you use, and the IDS configuration. Generic industry numbers will not apply to your network.

If you just want stats try NSS Labs, http://www.nsslabs.com. They do competitive testing for all types of security products and false positive rate is one of the metrics they use heavily.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .