RE: Wishlist for IPS Products

idswizard_at_earthlink.net
Date: 09/18/04

  • Next message: Gautam Singaraju: "Re: What is false alarm rate and false positive rate?" 
    To: <focus-ids@securityfocus.com>
Date: Sat, 18 Sep 2004 10:28:58 -0400

    > Only way to do this and not create tons of false postives is true protocol
    parsing. This knocks out most IPS vendors like Tipping Point.

    That is an interesting statement. Tipping Point claims to only have one
    customer experience a false positive and it was based on Chat traffic.
    During a SANS webcast, Los Alamos National Laboratory seemed to back that
    data (https://www.sans.org/webcasts/show.php?webcastid=90514).

    What test(s) have you done showing Tipping Point is prone to false positives
    based on their signatures/filters?

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
    --------------------------------------------------------------------------

  • Next message: Gautam Singaraju: "Re: What is false alarm rate and false positive rate?"