<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Wed, Jun 21, 2017 at 4:25 PM, dave aitel <span dir="ltr"><<a href="mailto:dave@immunityinc.com" target="_blank">dave@immunityinc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p>99% effective
with the kind of traffic a normal network sees means you are
FLOODED AND OVERWHELMED WITH FALSE POSITIVES. Although they
don't specify what that number even means. Is it false
positives? False negatives? Both? Let's just say this: 99.99% is
useless when doing a network-based IDS.</p></div></blockquote><div><br></div><div>More details are available in a technical report: <a href="https://arxiv.org/pdf/1607.01639.pdf">https://arxiv.org/pdf/1607.01639.pdf</a></div><div><br></div><div>Starting on page 8, the evaluation is explained in more detail. 99% reflects the accuracy, but the 1-in-10,000 false
discovery rate (FDR) is much lower even in their tests. Furthermore, all these results were obtained in synthetic tests where the ratio of malicious traffic to benign traffic was almost 1:1 ("In total, there were 225,740
malicious and 225,000 enterprise flows for this experiment")...</div><div><br></div><div>Cheers,</div><div> Thorsten</div></div></div></div>