Experiments to Evaluate S.A.F.E Sample Clauses

Experiments to Evaluate S.A.F.E. In order to evaluate S.A.F.E., its performance was compared to that of Snort 1.8.4- beta1. Using Snot 0.92a, 10 signatures were sent to a computer running Snort, to see how Xxxxx would respond to the signatures. Next, a Trust Domain of nine computers running S.A.F.E. was formed, and three nodes were selected at random to emulate the behavior of a compromised node. Then a signature was sent to one of the uncompromised nodes and the results were observed and recorded. This procedure was repeated 3 times for each signature. In each trial, the behavior of the compromised nodes was selected by having a random number generator pick the behavior from the set of possible behaviors. In these trials, when the SHM received the signatures, if they represented a likely attack, the SHM sent a message to the DTM. After that, if the signature was an attack, the SHM was set to behave as that particular node was compromised instantaneously. The 10 signatures that were used were determined by members of the WPI System Security Research Lab Research Group, in an attempt to create realistic attacks. The signatures were designed to emulate attacks on a computer. Each signature falls into one of three categories. Signatures are either clearly not an attack, clearly an attack, or it is unclear whether they are an attack. A low threshold and a high threshold separate the different types of signatures. Three of the signatures emulated an unsuccessful attack, and thus, they were assigned a probability less than the low threshold. Three of the signatures emulated a successful attack, and were assigned a probability greater than the high threshold. Four of the signatures emulated an attack that might be a successful attack or a failed attack. These were assigned a probability between the low and high thresholds. The assigned probabilities were .1, .9, and .5 respectively, which are arbitrarily chosen values that fall within the appropriate ranges When the signatures that were not definitely failed or successful attacks were sent, the tests were done twice. The first time they were done as if the attack had not been successful. The second time they were done, the SHM on the computer that had been “attacked” emulated being compromised.