SyncPoint based scoring method in IDS evaluation - YANG Wang1; GONG Jian1; WU Xiong1 (Tongxin xuebao)
Scoring the true positive rate and the false positive rate is a key component in IDS evaluation.The accuracy of the scoring method affects the effectiveness of the evaluation results.There are two kinds of scoring methods existed,one considering the false positive and the other not.But both of them aren’t accurate enough and don’t scale to the traffic volume increase.The characteristics required by the evaluating window was analyzed,and a SyncPoint based scoring method utilizing the features that the IDS processes the packet in a FIFO queue way was proposed.The theoretical analy-sis and the experiment show that the SyncPoint based scoring method is better than the current methods in accuracy and the scalability.