Re: [IDMEF][Issue 10] Severity scale too narrow

On Sun, 11 Jan 2004, David A. Curry wrote:

> I am way skeptical of any scheme that purports to assign numerical
> values to this type of data and claim that they are "accurate" in any
> meaningful way.
>
> As I recall, the group was similarly skeptical when the idea was
> proposed in the past (and it was proposed more than once).

If it's a done deal, it's a done deal, and please view my ramblings as
nothing more than comments from the peanut gallery.  (and please excuse me
and my monkey wrench!) I just know from EXPERIENCE that simple
classification metrics (e.g. 5 ratings) are not going to cut it in many
real world scenarios.  For example, when we were doing our SIM testing
last year in conjunction with Syracuse University we had days when we hit
2600 events PER SECOND from our IDS/FW sensors.  Without some ability to
classify/rank those events more granularly you can forget about ever
really sifting through the data, much less acting on it.

IMO, granular classification mechanisms are mandatory when dealing with
large data volumes.  Now, whether or not that classification falls under
the IDWG charter is, well, for you folks to decide!

As for your skepticism, I totally agree with your concern about accuracy.
However, we're watching the NIDS space evolve right under our noses, and
I'm going to speculate that confidence levels will be appearing in
commercial products in less than 12 months.  Take, for example,
SourceFire's RNA product; they are using passive vulnerability
identification techniques to gather data for alert classifications.
(e.g.  That MS RPC/DCOM alert is critical because the target is indeed
vulnerable to that MS RPC attack)  I believe SourceFire's RNA is shipping,
TODAY, and other vendors are not far behind.

(Perhaps one leaves the classification system intact, and inserts an
additional/optional confidence variable, instead?)

How does this relate to the IDWG?  Again, that's for you folks to decide,
and I really don't intend to cause problems here.  But, IMO, I'm guessing
that granular classification systems and/or confidence levels will be a
factor for commercial implementations.  The commercial market is already
moving there NOW.  (And I'd be curious to hear what any of them think, if
they are on this list, but I digress...)

My .02,

-Greg

P.S. As for the ascending vs. descending, as long as its documented and
consistent, I don't think it matters...  (Herve's choice?  :)