On Testing of Implementation Correctness of Protocol Based Intrusion Detection Systems

Intrusion Detection Systems (IDSs) are important components in the strategy of defense in depth for network security. Whether an IDS detects intrusions correctly or not depends on the correctness of both its design and the implementation. A survey of the literatures over the last decade reveals various methodologies for the evaluation and testing of network intrusion detection algorithms. However most of these efforts focus on signature based and anomaly based network IDSs. There is another approach of detection known as protocol based detection or protocol anomaly detection. In this paper, we propose an approach for testing the correctness of implementations of protocol based intrusion detection systems. We demonstrate that by adapting protocol conformance testing methodologies we can effectively test the correctness of the implementations.