Subject: proposed IDMEF modifications (Message 4 of 4: confidence)

From: Cynthia McLain <[email-masked]>
Date: Wed, 24 Oct 2001 08:39:11 -0400

3. Confidence
==============

The confidence attribute was removed from the Alert data model due to
concerns within the IDWG over the ability to assign a meaningful value
to this field. However, intrusion detection systems that use pattern
recognition (as opposed to signature analysis) produce posterior
probabilities that may be useful to other intrusion detection systems
downstream that perform alert correlation. Examples of systems that
produce posterior probabilities include SRI's EMERALD and two systems
developed in our group: DP2 and Stellar. Because of the potential
usefulness of this attribute we ask that it be reinstated.

If one of the concerns was that the confidence was a required value
and thus, would be set to an arbitrary value, that concern can be
addressed by allowing the attribute to be optional. In XML that
translates to:

    confidence      %attvals.confidence;     #IMPLIED

---

From: "Laura S. Tinnel" <[email-masked]>
Date: Wed, 24 Oct 2001 11:54:55 -0400

>3. Confidence

I'm not sure why this was removed, but I concur with this comment. Having 
worked with many of the folks developing intrusion correlators and higher 
level reasoning systems, it is clear to me that it is necessary to be able 
to express a confidence factor. Many of these systems engage in 
probabilistic reasoning. The consumers of reports from these system, 
particularly those which are also based on probabilities, use the report's 
probability factor in their own internal calculations.

-Laura