RE: Crossover Error Rate (WAS "Intrusion Prevention")

> -----Original Message-----
> From: Raistlin [mailto:raistlin@gioco.net]
> Sent: Wednesday, December 11, 2002 2:16 PM
> To: focus-ids@securityfocus.com
 

Actually, that depends. There are situations where a false accept is worse than a false reject, and vice versa. The point of the CER is merely to keep vendors from being able to cook the figures by tuning systems unrealistically for tests. (See under "IDS vendors who claim zero false positives.") In the end, however, it has proven true that the lower the CER, the more accurate and reliable the biometric system is, regardless of the specifics. And my hope is that a similar method can be developed for network-based IDS...it won't be a magic bullet for selection, but it would definitely clear some of the fog so that people who have to evaluate technologies can focus on their specific needs more than sorting out the truth from the half-truth. Received on Thu Dec 12 11:53:57 2002