Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation

Abstract

Abstract. Eight sites participated in the second DARPA off-line intrusion detection evaluation in 1999. Three weeks of training and two weeks of test data were generated on a test bed that emulates a small government site. More than 200 instances of 58 attack types were launched against victim UNIX and Windows NT hosts. False alarm rates were low (less than 10 per day). Best detection was provided by networkbased systems for old probe and old denial-of-service (DoS) attacks and by host-based systems for Solaris user-to-root (U2R) attacks. Best overall performance would have been provided by a combined system that used both host-and network-based intrusion detection. Detection accuracy was poor for previously unseen new, stealthy, and Windows NT attacks. Ten of the 58 attack types were completely missed by all systems. Systems missed attacks because protocols and TCP services were not analyzed at all or to the depth required, because signatures for old attacks did not generalize to new attacks, and because auditing was not available on all hosts.

Auto-Associative Neural Techniques for Intrusion Detection Systems

“…Hence, the proposed IDS operates at the packet level and not at the connection level as other models do [13,14]. Indeed, the design of the feature set is a crucial issue that has been thoroughly addressed in the literature [15].…”

IDS Based on Bio-inspired Models

“…The compression component processes an n-dimensional vector that has been previously assembled by a "packet processing" module, which extracts numerical features associated with each network packet. Hence, unlike other models which operate at the connection level [8], [9], the proposed IDS operates at the packet level. The design of the feature set is a crucial issue that has been thoroughly addressed in the literature [10].…”

On the Use of Different Statistical Tests for Alert Correlation – Short Paper

“…The alerts have to be generated by running various sensors on the data. The 1999 dataset [10], which we used for this work, has many known shortcomings. Firstly, it is evidently and hopelessly outdated.…”