Re: Question: DARPA's Common Intrusion Detection Framework (CIDF)and the IDWG effort to refine the CIDF and get it commercially accepted

Robert,

I agree with Felix's statements.

S. Felix Wu wrote:
> Therefore, the IDWG working group was formed, and Stuart and Mike were
> the first chairs for the working group. IDWG basically abandoned CIDF
> and S-expression (at least initially) and started from "requirement
> study". We then ran into the debate of issues such as SNMP versus XML.
> S-expression was not discussed very much after that point.

The most difficult point of the IDWG work has been the data model.

> I personally believe that an industry standard is still needed as we
> have many more powerful networ/host IDS systems today. And, from the
> research community, I feel that we know a lot better about what should
> be standardized than say 7~8 years ago. And, I see a critical need for
> interoperability and inter-domain security operations now and in the
> future. I think we should think about all the issues again.

That is true. However, given the IDMEF experience, I would really like
that this becomes experimental RFC, that the WG in its current form
closes, and that we start a new effort.

> Dr. Robert G. Rains wrote:
>> ONE LAST QUESTION:
>> Did draft-ietf-idwg-idmef-xml-14 expire on 31 July 2005, or has it
>> been adopted as a standard?  To the best of your knowledge, are at
>> least two different commercial organizations developing products based
>> on this draft standard?

It hasn't yet, but getting close.

Yes, there are several companies that have developped products based on
the standard:

- France Telecom
- Exaprotect
- Prelude IDS technologies

are the ones that come immediately to my mind (caveat: I work for FT). I
can give you contact names and email should you wish to investigate
further with these companies.

Besides, I have seen numerous references to IDMEF in academic papers,
the open source prelude-ids project is based on IDMEF, and there have
been other open source implementations.

Best regards,

Herv=E9
--=20
Herv=E9 Debar             <mailto:[email protected]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France T=E9l=E9com R&D              (new)Fax: +33 (0)2 31 37 83 43
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4