Hello everyone. I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used.
The dataset itself is the AFDA-LD dataset which can be found here http://www.cybersecurity.unsw.adfa.edu.au/ADFA%20IDS%20Datasets/ This dataset consists of 3 groups of raw system call traces generated with auditd UNIX program: 1. 1. Normal training data 2. 2. Normal validation data 3. 3. Attack data. The method used to perform this task is irrelevant as long as I manage to use this particular dataset with OSSEC. So far I have the latest version of OSSEC installed on Ubuntu 14.04. I suppose that in order to perform my task, OSSEC should first be trained using the normal training data of the dataset and then tested for false positives using the normal validation data and for attack detection using the attack data. I am however quite new when it comes to OSSEC and IDS in general so I could very easily be wrong when it comes to that assumption. So my question is - Can OSSEC be trained and tested with raw system call traces in the first place, and if yes, how? If not, can the data from this particular dataset be used in any other way in order to test effectiveness of OSSEC? Thank you Miroslav -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
