Re: Question: DARPA's Common Intrusion Detection Framework (CIDF)and the IDWG effort to refine the CIDF and get it commercially accepted

.  Hi.  I do sympathize with the desire to get a standardized
intrusion detection format.

If IDMEF and IDWG do fail, it will not prevent future efforts from
being considered in the IETF or elsewhere.

I would be happy to be approached by efforts that are likely to meet
engineering success.

However, the IETF is not an appropriate forum to "do science."  In
particular, the IETF is not an appropriate forum to research new
proposals or to design experiments.  The IRTF may be such a forum.

The IETF is an appropriate forum when we get to a point where we can
design standards (possibly based on research) for use in products
deployed on production networks.

One implication of this is that for an effort to be successful in the
IETF you will need vendors who plan to implement the standard
involved.  If there are no such vendors, then the effort is very
unlikely to succeed.


Sam hartman
Security Area Director