Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation

摘要: An intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100's of users 1000's hosts. More than 300 instances 38 different automated attacks were launched against victim UNIX hosts in seven weeks training data and two data. Six research groups participated blind results analyzed for probe, denial-of-service (DoS) remote-to-local (R2L), user root (U2R) attacks. The best systems detected old included the data, at moderate rates ranging from 63% 93% false alarm rate 10 alarms per day. Detection much worse new novel R2L DoS only failed detect roughly half these damaging access root-level privileges by remote users. These suggest further should focus developing techniques find instead extending existing rule-based approaches.