Re: How can I recognize Snort rules with high false positive rate?

["Keith W. McCammon" <keith-list () mccammon org>]

> In my network, low false positive rate is very more important than low
> false negative rate.

Ummm, I think you have it backwards.  False positives suck, but they can 
be dealt with.  False negatives mean that attacks are bypassing the 
sensor without detection.  If you don't mind false negatives, you're 
wasting your time running an IDS.

> I need someway to classify Snort rules to "with low false positive
> rate" and "with high false positive rate" categories.
> How can I recognize these rules?

No one but you can tell.  Analysts determine false positives by looking 
at alert data in the context of their own environments, and determining 
which attacks are being caused by known valid traffic.

> Does Snort rules' "classtype" and "priority" indicate their "false
> positive(or negative) rate"?

No.  See above.  The classtype indicates a type or class of attack, such 
as privilege escalation.  Priority indicates the pre-assigned severity 
of the attack.  For instance, a ping sweep would have a lower priority 
that a buffer overflow, because one returns information to the attacker, 
and one give the attacker root.

> If yes, how?
> If no, how can I get some information about this?

I would recommend checking out Network Intrusion Detection by Novak and 
Northcutt.  I think you're a little off base with the point if the 
system itself, and the analysts role in making the final determination 
between harmless and malicious detects.


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users