RE: [IDMEF][Issue 10] Severity scale too narrow

 
Greg, 

	I agree using an integer to describe the level of severity is a
necessity. Our SIM/SEM solution already reassign the priority into
numeric form in the aggreagation phase. It could be made better for
everyone if assignment was already in the logging format. For example:
HIGH = 255 , MEDIUM = 128 LOW = 64. It is faster and more efficient to
use an integer format in correlation primarily because string
comparisons are costly CPU wise. When you compute/correlate/classify
3000/eps any CPU cycles you can spare increases the effectiveness of the
SIM/SEM solution and or analysts running queries on databases.  

Matt


Matthew F. Caldwell, CISSP
Founder and Chief Security Officer
GuardedNet, Inc. (neuSECURE)
Web:www.guarded.net
Email:[email protected]
Phone: 404-591-8250

-----Original Message-----
From: Greg Shipley [mailto:[email protected]] 
Sent: Monday, January 12, 2004 5:50 PM
To: David A. Curry
Cc: [email protected]; intrusion detection wg
Subject: Re: [IDMEF][Issue 10] Severity scale too narrow 


On Sun, 11 Jan 2004, David A. Curry wrote:

> I am way skeptical of any scheme that purports to assign numerical 
> values to this type of data and claim that they are "accurate" in any 
> meaningful way.
>
> As I recall, the group was similarly skeptical when the idea was 
> proposed in the past (and it was proposed more than once).

If it's a done deal, it's a done deal, and please view my ramblings as
nothing more than comments from the peanut gallery.  (and please excuse
me and my monkey wrench!) I just know from EXPERIENCE that simple
classification metrics (e.g. 5 ratings) are not going to cut it in many
real world scenarios.  For example, when we were doing our SIM testing
last year in conjunction with Syracuse University we had days when we
hit 2600 events PER SECOND from our IDS/FW sensors.  Without some
ability to classify/rank those events more granularly you can forget
about ever really sifting through the data, much less acting on it.

IMO, granular classification mechanisms are mandatory when dealing with
large data volumes.  Now, whether or not that classification falls under
the IDWG charter is, well, for you folks to decide!

As for your skepticism, I totally agree with your concern about
accuracy.
However, we're watching the NIDS space evolve right under our noses, and
I'm going to speculate that confidence levels will be appearing in
commercial products in less than 12 months.  Take, for example,
SourceFire's RNA product; they are using passive vulnerability
identification techniques to gather data for alert classifications.
(e.g.  That MS RPC/DCOM alert is critical because the target is indeed
vulnerable to that MS RPC attack)  I believe SourceFire's RNA is
shipping, TODAY, and other vendors are not far behind.

(Perhaps one leaves the classification system intact, and inserts an
additional/optional confidence variable, instead?)

How does this relate to the IDWG?  Again, that's for you folks to
decide, and I really don't intend to cause problems here.  But, IMO, I'm
guessing that granular classification systems and/or confidence levels
will be a factor for commercial implementations.  The commercial market
is already moving there NOW.  (And I'd be curious to hear what any of
them think, if they are on this list, but I digress...)

My .02,

-Greg

P.S. As for the ascending vs. descending, as long as its documented and
consistent, I don't think it matters...  (Herve's choice?  :)

BEGIN:VCARD
VERSION:2.1
N:Caldwell;Matthew
FN:Matthew F. Caldwell
ORG:GuardedNet.Inc, USA;Executive
TITLE:CSO
TEL;WORK;VOICE:404-591-8250
TEL;CELL;VOICE:404-936-6299
ADR;WORK;ENCODING=QUOTED-PRINTABLE:;Atlanta - Corporate;206 Reinhardt Street=0D=0AA1;Atlanta;GA;30312;UNITED ST=
ATES
LABEL;WORK;ENCODING=QUOTED-PRINTABLE:Atlanta - Corporate=0D=0A206 Reinhardt Street=0D=0AA1=0D=0AAtlanta, GA 30312=
=0D=0AUNITED STATES
EMAIL;PREF;INTERNET:[email protected]
REV:20031007T184838Z
END:VCARD