The NIDES Statistical Component Description and Justification

Preface SRI International has prepared this document as a full and complete disclosure of the Next-Generation Intrusion-Detection Expert System (NIDES) [3] statistical algorithm , including how it works, what decisions influenced the form of the algorithm, and the rationale behind those decisions. We have divided this document into four sections: • Chapter 1 is a description of the NIDES statistical algorithm. It describes what the algorithm is and how it functions. • Chapter 2 is a broad justification for the NIDES statistical algorithm. This section also includes a comparison to other statistical approaches to intrusion detection. • Chapter 3 is a set of statistical criteria that can be used to evaluate the ap-propriateness of any statistical approach to intrusion detection. Although we did not formally use these criteria in the development of the NIDES statistical algorithm, they nevertheless had an important influence on the development of the algorithm. They may also be used to evaluate the suggestions of other statistical algorithm developers. • Chapter 4 is a set of specific questions and answers that can be posed about the NIDES statistical algorithm. In this section we explore in more depth the specific choices we made in developing the NIDES statistical algorithm. We have found it convenient to use the question-and-answer format to address the relationship of the NIDES statistical algorithm to the work of Helman et al.