Improving intrusion detection systems through heuristic evaluation

This work is a report on efforts to improve the usability of intrusion detection systems. Specifically, we first conducted a worldwide survey of system administrators from different countries and economic sectors to understand the state of practice in security management with a particular focus on intrusion detection systems (IDS). Then, based on these survey results and in depth interviews, we developed new heuristics to measure the effectiveness and efficiency of IDS. The comparison of our refined heuristics and Nielsen´s general heuristics on Snort, Snortsnarf and our proposed interface show that evaluators using our heuristics find significantly (p<0.0002) more of the problems. Also, evaluations with both sets find fewer problems in our interface than in Snort or Snortsnarf.