[Snort-users] A New White Paper - Baseline Analysis of Security Data

Hello,
 
A new white paper has been released by the Securimine Team. To download
the white paper, go to http://www.securimine.com/product.html
 
Title: Baseline Analysis of Security Data
 
Abstract: Regardless of the development in the SIM (Security Information
Management) area, there is still a huge problem with existing detection
tools. Although these tools detect all the intrusions, they detect much
more than that. This problem, known as false positives, is a big barrier
for intrusion detection tools to cross before their deployment can be
practical. To date, intrusion detection vendors, or more precisely
security experts, are struggling with an inherent conflict and are
sometimes forced to write less adequate detection rules just to reduce
the number of false positives.
 
In this paper we suggest a different approach for using data mining
technology in the intrusion detection area. We claim that the best
positioning for a data mining technology within an intrusion detection
system is not as a detection engine, but rather as an analysis layer
that will filter out the false positives. The ability of data mining
technology to build behavioral models representing 'normal' behavior of
data is most suitable to model the data generated by the intrusion
detection engines.
 
 
Best regards,
 
The Securimine Team
www.securimine.com <http://www.securimine.com/>