Defining categories to select representative attack test-cases

To ameliorate the quality of protection provided by intrusion detection systems (IDS) we strongly need more effective evaluation and testing procedures. Evaluating an IDS against all known and unknown attacks is probably impossible. Nevertheless, a sensible selection of representative attacks is necessary to obtain an unbiased evaluation of such systems. To help in this selection, this paper suggests applying the same approach as in software testing: to overcome the problem of an unmanageably large set of possible inputs, software testers usually divide the data input domain into categories (or equivalence classes), and select representative instances from each category as test cases. We believe that the same principle could be applied to IDS testing if we have a reasonable classification. In this paper we make a thorough analysis of existing attack classifications in order to determine whether they could be helpful in selecting attack test cases. Based on our analysis, we construct a...

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: Mohammed S. Gadelrab, Anas Abou El Kalam, Yves Deswarte
• Keywords: Attack Test Cases, CCS 2007, Intrusion Detection Systems, Security Privacy, Test Cases