Re: too many false alarms

Stefano Zanero <[email protected]> Fri, 25 Jan 2008 20:35:47 +0100

Newsgroups	gmane.comp.sysutils.loganalysis
Organization	DEI - Politecnico di Milano
Message-ID	<[email protected]>

Andrew Hay wrote:
> As a follow-up(-on) to Ron's response, I think that the resource being 
> accessed also plays a role in determining the "acceptable" false alarm 
> rate and the perceived usefulness of an anomaly detection system. I 

In order to help everybody avoid reinventing the wheel, terminology and
formulas for these considerations are contained in:
http://portal.acm.org/citation.cfm?id=319710

-- 
Cordiali saluti,
Stefano Zanero

Politecnico di Milano - Dip. Elettronica e Informazione
Via Ponzio, 34/5 I-20133 Milano - ITALY
Tel.    +39 02 2399-4017
Fax.    +39 02 2399-3411
E-mail: [email protected]
Web:    http://home.dei.polimi.it/zanero/