An Information-Theoretic Framework for Evaluating and Optimizing Intrusion Detection Performance
Wenke Lee · 2008
Abstract : We conducted in-depth study of performance metrics used in evaluating intrusion detection systems. We define Intrusion Detection Capability as the ratio of mutual information between the IDS input and output to the entropy of the input. It integrates all the important factors into a single metric. We showed that this new metric is very sensitive to IDS operation parameters. We also defined information-theoretic metrics to measure the effectiveness of an IDS in terms of feature representation capability, classification information loss and the overall intrusion detection capability. We showed that intrusion detection capability is equal to the feature representation capability minus the classification information loss. Finally, we proposed a decision-theoretic IDS alert fusion technique based on the likelihood ratio test (LRT).