Table 9 Statistics for Misuse Detection with Snort
From: Comparison of approaches for intrusion detection in substations using the IEC 60870-5-104 protocol
Predicted class | ||
|---|---|---|
Normal | Attack | |
True class | ||
normal | 50000 | 0 |
Nmap | 0 | 500 |
Syn Flood | 3 | 497 |
Nessus | 354 | 146 |
Fuzzy | 466 | 34 |