Re: Intrusion Prevention Firewall

[Vern Paxson <vern () icir org>]

> The key question is the 
> false positive rate.

Yep!

> Is it the case that your Bro IDS scripts are not 
> generating false positives? Or that your users don't mind so much if a 
> legitimate session gets killed? Or a compromise, where the proactive 
> session-killing is only connected to IDS scripts that have particularly 
> low false positives?

It's in particular the last.

We get a false positive every couple of weeks, and of course we work on
ways to lower them.  (Bro is conducive to adding these sorts of exceptions.)

But we get dozens of true positives every day, which is the pay-off.

                Vern
_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards