ossim - AlienVault

2. The Detection Process
If we had to summarize what we are trying to accomplish or what our project is about in a single
phrase, it would be this: “Improve Detection Capability”
In this section we will introduce the concepts related to network detection that will be developed
throughout the document.
Detectors
We define a detector as any program capable of processing information in real time, usually low
level information like traffic or system events, and capable of sending alerts when previously
defined situations arise.
These situations can be defined in either of two ways:
1. By patterns, or rules defined by the user
2. By anomaly levels
Detection Capability
Detection capabilities have improved enormously in recent years, the best example being IDSs,
which are capable of detecting patterns at the most detailed level.
In order to discuss the capability of a detector, we will define it using two variables:
• Sensitivity or the capability our detector has for extensive and complex analysis in
identifying possible attacks.
• Reliability, which, as its name suggests, is the level of certainty provided by our detector
when we receive warning of a possible event.
Inadequate Detection
Throughout this document we will see that despite advances in the scope of detection systems,
their capabilities are still far from acceptable.
Because of detector inadequacy in these two areas, we are confronted with the two main
problems encountered today:
• False positives. Detector unreliability or alerts that actually do not correspond to real
attacks.
• False negatives. Inadequate detection means that attacks go unnoticed.
8