Patent ID: 7941856
Filing Date: 2011-05-10
Classification: H04L

Abstract:
1. A method for testing an intrusion detection system of a type monitoring a network input to detect attacks against a network that would permit unauthorized access to or use of the network, the method executed on at least one electronic computer according to a stored program, comprising: generating from at least one known attack, a plurality of attack instances, the plurality of attack instances being generated by modifying the known attack using a plurality of transformation rules of a formal transformation system, the transformation rules changing data of the known attack while preserving the effect of the known attack as an attack on a network that would permit unauthorized access to or use of the network; presenting to the intrusion detection system being tested at the network input of the intrusion detection system, each of a plurality of attack instances; determining, for each presented attack instance, cases when the intrusion detection system being tested is presented with an attack instance and the intrusion detection system does not identify the attack instance as an attack in response to being presented with that attack instance; and evaluating the intrusion detection system being tested based on the determining of cases when the intrusion detection system being tested is presented with an attack instance and the intrusion detection system does not identify the attack instance as an attack, such cases indicating failure of the intrusion detection device to protect the network from attacks of a type intended to permit unauthorized access to or use of the network.