Re: Rule Load Formula

Quoting Matt Jonkman 
<jonkman-WwB1pFISwSkm7effSn6vN9HuzzzSOjJt@xxxxxxxxxxxxxxxx>:

> Good points. But to measure load, you have to consider the traffic that
> the sensor will see, as well as the rules.

The value of any metric is the relevance and applicability to some  
activity.  The reasons one would care about rule 'efficiency' are to  
either:

Case 1.  Make comparitive choices about how to best code a specific rule; or

Case 2.  Calculate total load units imposed by adding some rule to an  
existing rule base; or

Case 3.  Compare processing cost of triggering an alert on rule X,  
versus triggering an alert on rule Y.  In the case I wanted to load  
one or the other, but not both, or if they both trigger on the same  
event, but take very different processes to get there.  ( there are  
many paths up any mountain ).

the first one is probably solvable.  and probably quite useful if we  
could "in batch" load a hopper full of rules in one end and get a  
sleek, trim, non redundant, flowbit-ordered,  etc, etc rule set out  
the other end.

The second case requires a benchmark corpus as descirbed by Matt.  If  
a benchmark dataset can be developed, maintenance of the dataset could  
be an issue.  I don't think this is solvable.  the 'cost' of running a  
particular rule needs to weighed against the value derived by  
successfully triggering a valid alert, subtract the probabliity of  
false positives, etc.  Not solvable in a finite algorithm.

The third case could be useful, but I can't right now envision how I  
would use the information.

jp

-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services-MMNQ1ylbVXZN8Ch2cx6nig@xxxxxxxxxxxxxxxx