Network Intrusion Detection Systems Fail to Impress

TheBongPipe writes "I'm reading a nice test here about 7 commercial IDSs. Who won the prize? Nobody..." They also looked at Snort, but found that all the products generated way too many false alarms.

Comments

False Positives...

[Liora]

Like a pregnancy test, I think the false positives are preferable to sitting around thinking you're safe.

Always compare with a placebo

[Anonymous Coward]

Compare with my program that suddenly displays "!!! RED ALERT !!!" at random.

Re:Always compare with a placebo

[alienmole]

Why use your program when we already have the Homeland Security Advisory System to raise meaningless alerts at random?

Re:What does everyone use

[Lord_Slepnir]

I use snort, but it's not easy to set up and tweak properly, way too many false alarms.

Yeah, me too. All that special lab equipment to refine it, and the look out always saying the cops are coming when half the time it's just a meter-maid....

Everything's OK!

[runlvl0]

Homer: Now, here's my "Everything's O.K."alarm!
[Homer flips a switch on the device, and it begins to emit a high pitched, incredibly loud beep. The rest of the Simpsons cover their ears as Homer speaks up]
Homer: This will sound every three seconds, unless something isn't okay!
Marge: Turn it off, Homer!
Homer: It can't be turned off! [alarm fizzles out] But it, uh, does break easily.
-- "The Wizard of Evergreen Terrace"

This sounds about as useful.

Darned "false alarm" criterion.

[dave_mcmillen]

They also looked at Snort, but found that all the products generated way too many false alarms.

Curses, foiled again! If it weren't for that pesky "not too many false alarms" requirement, I'd be able to create terrific security software. I'm picturing a system that generates a "WARNING: NETWORK SECURITY BREACH" message every five minutes, rain or shine. Keeps the sysadmins on their toes, and foils all network intruders who aren't fast enough to be in and out in five minutes.

Re:Car Alarms

[Asprin]

Like Car Alarms, if it goes off all the time, people will just ignore it -- At some point, the noise drowns out the signal.

Yup, yup, I *know* what you mean!

I've got RAID array in my office that's part of the main production file server and there's this alarm that's been going off for, like, 16 MONTHS on the thing. Don't worry, it's not important - it's only a fan in the back of the drive tray that gets stuck sometimes, then it works itself loose and everything goes back to norm@#&$%@#$89d sifsd00JE{PGJE....