Subject: proposed IDMEF modifications (Message 1 of 4: intro)

From: Cynthia McLain <[email-masked]>
Date: Wed, 24 Oct 2001 08:39:01 -0400

Our group at Lincoln Laboratory is working in the field of information
assurance research. We are developing various systems and testbeds for
which we have been exploring the use of IDMEF for alert representation.
The use of a standardized alert format is very attractive to us since
we would like to have various systems interoperate and it should also
make it much easier to analyze the data from different intrusion
detection
systems. For these reasons we are very grateful for the work being done
by the Intrusion Detection Working Group on the IDMEF standard.

While IDMEF seems to be well thought out and fairly complete, during
the course of investigating the use of IDMEF for a host-based intrusion
detection system (BIDS), we identified some possible areas for
improvement
in the IDMEF specification. We think these improvements will allow
IDMEF to better meet the objectives it has gone a long way toward
addressing, which is to enable plug-and-play interoperability among 
a variety of intrusion detection systems.

The discussion of the proposed changes is divided into three sections.
The first section proposes modifications to better support the types
of alerts reported by host-based intrusion detection systems. The
second section revisits the newly added action attribute of Alert
with an alternate proposal for an Action class. The third section
provides some additional arguments for reinstating the confidence field.
Each of these sections will be published as a separate posting to
the mailing list.

We look forward to receiving your feedback on these proposals. 

Thanks,
--Cindy
------------------------------------------------------------
Cynthia D. McLain                 M.I.T. Lincoln Laboratory
Information Systems Technology    244 Wood Street
phone:  781-981-3943              Lexington, MA 02420-9108
e-mail: [email-masked]       Fax: 781-981-0186
------------------------------------------------------------