Snort – Network Intrusion Detection and Prevention System
&gt; Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.<p>At IBM&#x27;s Watson lab, I tried <i>rules</i> and was not thrilled.<p>E.g., there was no way to know what the false alarm rate was or to adjust it or know what change in the false alarm rate an particular adjustment would make.<p>And the rate of missed detections was also a problem.  For that, for the highest possible detection rate, there is the Neyman-Pearson result, and we should at least try to do something similar in practice!<p>And to write the rules, it appeared needed an <i>expert</i> in the system being monitored.<p>So I worked up some solutions, responses to these issues, with some math, and published.<p>But the people using <i>rules</i> are correct!  Rules are what the market wants!