Re: SnortML Benchmarking

Hey Charlie,

SnortML’s model is in experimental stage and currently enabled by default only in high security policies like Max-Detect. As we improve the efficacy and performance, model and inspector will get enabled in other base policies too.

You can use snort profiler or any other perf measuring tool for your internal benchmark testing with your custom model and traffic generator that has http uri’s.

Performance also depends heavily on how the model is written and traffic it sees.

Thanks!

--
V/r
Nihal N. Desai

From: Snort-users <[email protected]> on behalf of Li, Charlie via Snort-users <[email protected]>
Date: Tuesday, April 30, 2024 at 10:57 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] SnortML Benchmarking

[AMD Official Use Only - General]

Hello All,

SnortML was released recently, and I am wondering if there is a way to benchmark SnortML performance.
Snort Blog: Talos launching new machine learning-based exploit detection engine<https://blog.snort.org/2024/03/talos-launching-new-machine-learning.html>

Regards,
Charlie Li

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette