A selection criteria for intrusion detection systems

Abstract

A set of criteria is introduced for comparing and assessing intrusion detection systems. The theory, requirements classes, metrics and practical application of the criteria are discussed. 15 specific requirements are described and broken down into Class A, Class B and Class C compliance. A questionnaire for obtaining vendor information is shown; advice and experiences from test evaluations are given, based on our use of the criteria with several commercially available systems.