Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation

摘要: Eight sites participated in the second DARPA off-line intrusion detection evaluation 1999. Three weeks of training and two test data were generated on a bed that emulates small government site. More than 200 instances 58 attack types launched against victim UNIX Windows NT hosts. False alarm rates low (less 10 per day). Best was provided by network-based systems for old probe denial-of-service (DoS) attacks host-based Solaris user-to-root (U2R) attacks. overall performance would have been combined system used both host- detection. Detection accuracy poor previously unseen new, stealthy, Ten completely missed all systems. Systems because protocols TCP services not analyzed at or to depth required, signatures did generalize new attacks, auditing available