Eight sites participated in the second Defense Advanced Research Projects A
gency (DARPA) off-line intrusion detection evaluation in 1999. A test bed g
enerated live background traffic similar to that on a government site conta
ining hundreds of users on thousands of hosts. More than 200 instances of 5
8 attack types were launched against victim UNIX and Windows NT hosts in th
ree weeks of training data and two weeks of test data. False-alarm rates we
re low (less than 10 per day). The best detection was provided by network-b
ased systems for old probe and old denial-of-service (DoS) attacks and by h
ost-based systems for Solaris user-to-root (U2R) attacks. The best overall
performance would have been provided by a combined system that used both ho
st- and network-based intrusion detection. Detection accuracy was Door for
previously unseen, new, stealthy and Windows NT attacks. Ten of the 58 atta
ck types were completely missed by all systems. Systems missed attacks beca
use signatures for old attacks did not generalize to new attacks, auditing
was not available on all hosts, and protocols and TCP services were not ana
lyzed at all or to the depth required. Promising capabilities were demonstr
ated by host-based systems, anomaly detection systems and a system that per
forms forensic analysis on file system data. (C) 2000 Elsevier Science B.V.
All rights reserved.