EURASIP Journal on Information Security

Table 6 Complexity features and their correlations with signature effectiveness for 165 good signatures

From: A quality metric for IDS signatures: in the wild the size matters

	Signature class
Complexity feature	C&C Communication	Reporting	Egg Download	Redirection	Propagation	All signatures
Bytes checked	0.95	0.52	0.30	0.88	0.65	0.84
Fields checked	0.94	0.60	0.55	0.87	0.61	0.83
Byte offset is set	0.48	0.28	0.54	0.62	0.34	0.51
Regular expression is set	0.48	0.27	0.59	0.73	0.35	0.52
Regular expression size	0.73	0.24	0.51	0.63	0.30	0.37
Destination port is set	0.49	0.19	0.13	0.35	0.29	0.24
Packet size is set	0.19	0.12	0.19	0.16	0.40	0.12
Flow options are set	0.91	0.78	0.60	0.41	0.48	0.68
IP options are set	0.53	0.42	0.48	0.53	0.73	0.56

We highlight in bold correlation values higher than 0.4.

Back to article page