If by "real" you mean standard Internet noise (port scans etc) then I
would say very approximately 6 events per minute, based on what I see on
our many Internet firewalls. This is of course a function of the size of
the IP subnet on that link. E.g. a class C gets a lot less malicious
packets than a class B because it has 1/255th of the IPs. Also if the
subnet contains say amazon.com it is going to be much more attractive
and therefore you will see many more probes.
Without knowing how much legitimate bandwidth you are sending I couldn't
say what the ratio is. But for a typical website with 10Mb/s of
legitimate traffic it is a fraction of a %
I guess you need to think about the maximum performance of your solution
and therefore you should err on the side of caution and go for a heavy
amount of attack traffic e.g. 5% or more.
-----Original Message-----
From: Joel Esler [mailto:eslerj@gmail.com]
Sent: 12 July 2005 15:48
To: david.sames@sparta.com
Cc: focus-ids@securityfocus.com
Subject: Re: IDS evaluations procedures
depends on the bandwidth of the network.
On 12 Jul 2005 02:40:18 -0000, david.sames@sparta.com
<david.sames@sparta.com> wrote:
I'm in the process of developing test procedures for evaluating an
internal anomaly-based detection system. I'd like to construct a test
set of nominal data peppered with attack data. What is a reasonable
ratio of attack data to "normal" traffic that is representative of
"real" systems.
Thanks,
Dave
------------------------------------------------------------------------
--
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
------------------------------------------------------------------------
--
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
