Conclusions

• IDS lacks focus as a research topic, and is a geniunely Hard Problem

• But - lots of hype and FUD drive R&D and the commercial market

• An attacker's perspective is required to build reliable, dependable IDSs - so don those grey hats

• Without proper software testing and publicly-available test suites (read: exploits), IDSs will continue to be toy systems

• Money is better spent on systems to prevent misuse than on systems to detect it