Viewing IDS alerts: lessons from SnortSnarf

We consider the design of the user interface to an intrusion detection system console. We first analyze the requirements for this problem; our analysis is novel because we consider the possibility that an attacker can deliberately create spurious packets or audit records purely for the purpose of triggering the intrusion detection system. By this means, he can attempt to control the screen real estate of the security personnel using the IDS in such a way as to disguise the true nature of her activity. We also consider the way in which the ubiquitous false alarms generated by intrusion detection systems impact the console design. Next we describe a simple Web-based prototype console for the Snort IDS built by us: SnortSnarf. It partially embodies the analysis described above. We explain the features of SnortSnarf's design and informally describe some of the experience of the IDS community in using it. We discuss possible future research.