A Survey and Comparison of Performance Evaluation in Intrusion Detection Systems

Performance evaluation is an important aspect when designing a system. However, with intrusion detection systems (IDS), there are many other factors to consider. What are the metrics which are being used to compare the systems? Which attacks do particular approaches detect? Is the solution able to adapt and recognize new attacks, or is it limited to a set of attacks which were known at the time the system was designed? This chapter provides an overview of some of these concerns and tries to highlight in each surveyed IDS which metrics are used for performance evaluation, whether or not the solution is flexible, and which attacks the IDS is able to detect. This will provide the reader with a good basis for choosing the type of approach to use to guard against attacks, or as a basis to dig deeper into a particular aspect of intrusion detection.