The Base-Rate Fallacy and the Difficulty of Intrusion Detection

ACM Transactions on Information and System Security

Volumn 3, Issue 3, 2000, Pages 186-205

  Axelsson, Stefan ^a  

^a ERICSSON RESEARCH   (Sweden)

Author keywords

Base rate fallacy; detection rate; false alarm rate; intrusion detection; Performance; Security; Theory

Indexed keywords

EID: 84928016636     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/357830.357849     Document Type: Article

References (22)

1. Axelsson, S., Lindqvist, U., Gustafson, U., and Jonsson, E. 1998. An approach to UNIX security logging. In Proceedings of the 21st NIST-NCSC National Conference on Information Systems Security (Crystal City, Arlington, VA, Oct. 5-8). National Institute of Standards and Technology, Gaithersburg, MD, 62-75
2. Deatherage, B. H. 1972. Auditory and other sensory forms of information. In Human Engineering Guide to Equipment Design: Army, Navy, Air Force, H. Van Cott and R. Kinkade, Eds
3. Debar, H., Becker, M., and Siboni, D. 1992. A neural network component for an intrusion detection system. In Proceedings of the ACM/IEEE Symposium on Research in Security and Privacy (Oakland, CA, May). IEEE Computer Society Press, Los Alamitos, CA, 240-250
4. Denning, D.E. 1987. An intrusion-detection model. IEEE Trans. Softw. Eng. SE-13, 2 (Feb.), 222-232
5. Denning, D. E. and Neumann, P. G. 1985. Requirements and model for IDES: A real-time intrusion detection system
6. Halme, L. and Kahn, B. 1988. Building a security monitor with adaptive user work profiles. In Proceedings of the 11th National Computer Security Conference (NIST-NCSC, Baltimore, Maryland, Oct.17-20). National Institute of Standards and Technology, Gaithersburg, MD.
7. Helman, P. and Liepins, G. 1993. Statistical foundations of audit trail analysis for the detection of computer misuse. IEEE Trans. Softw. Eng. 19, 9 (Sept.), 886-901
8. Lane, T. and Brodley, C. E. 1999. Temporal sequence learning and data reduction for anomaly detection. ACM Trans. Inf. Syst. Secur. 2, 3, 295-331
9. Lee, W. 1999. A data mining framework for building intrusion detection models. In Proceedings of the 1999 IEEE Computer Society Symposium on Research in Security and Privacy (Berkeley, CA, May). IEEE Computer Society Press, Los Alamitos, CA, 120-132
10. Lippmann, R. P., Fried, D., Graf, I., et al. 2000. Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation. In Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX '00, Hilton Head, South Carolina, Jan. 25-27). IEEE Computer Society Press, Los Alamitos, CA, 12-26
11. Lunt, T. F. 1988. Automated audit trail analysis and intrusion detection. In Proceedings of the on 11th National Computer Security Conference (NIST-NCSC, Baltimore, Maryland, Oct.17-20). National Institute of Standards and Technology, Gaithersburg, MD, 65-73
12. Matthews, R. 1996. Base-rate errors and rain forecasts. Nature 382, 6594-6766
13. Matthews, R. 1997. Decision-theoretic limits on earthquake prediction. Geophys. J. Int. 131, 3 (Dec.), 526-529
14. Mchugh, J. 2000. Testing intrusion detection systems: A critique of the 1998 and 1999 Lincoln Laboratory evaluations. ACM Trans. Inf. Syst. Secur. 3
15. Pierce, G. M. 1943. Destruction by demolition, incendiaries and sabotage: Field training manual, Fleet Marine Force, US Marine Corps
16. Rasmussen, J. 1986. Information Processing and Human-Machine Interaction: An Approach to Cognitive Engineering. North-Holland Publishing Co., Amsterdam, The Netherlands
17. Russell, S. J. and Norvig, P. 1995. Artificial intelligence: a modern approach. Prentice-Hall series in artificial intelligence. Prentice-Hall, Inc., Upper Saddle River, NJ
18. Sebring, M. M., Shellhouse, E., Hanna, M. E., and Whitehurst, R. A. 1988. Expert systems in intrusion detection: A case study. In Proceedings of the 11th National Computer Security Conference (NIST-NCSC, Baltimore, Maryland, Oct.17-20). National Institute of Standards and Technology, Gaithersburg, MD, 74-81
19. Trees, H. L. V. 1968. Detection, Estimation, and Modulation Theory, Part I: Detection, Estimation, and Linear Modulation Theory. John Wiley and Sons, Inc., New York, NY
20. Vaccaro, H. S. and Liepins, G. E. 1989. Detection of anomalous computer session activity. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA, May 1-3). IEEE Computer Society Press, Los Alamitos, CA, 280-289
21. Warrender, C., Forrest, S., and Perlmutter, B. 1999. Detecting intrusions using system calls: Alternative data models. In Proceedings of the 1999 IEEE Computer Society Symposium on Research in Security and Privacy (Berkeley, CA, May). IEEE Computer Society Press, Los Alamitos, CA, 133-145
22. Wickens, C. 1992. Engineering Psychology and Human Performance. 2nd ed. HarperCollins Publishers, New York, NY