Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] False-Positives handling with heuristic filters

From: Roland Knall <rknall@xxxxxxxxx>
Date: Tue, 2 Sep 2014 08:13:27 +0200
Hi

I have a more general question: At what point do you stop carrying about false-positives with a heuristic filter?

I have openSAFETY traces, where less then 0,2% of all displayed frames are false-positives. But I cannot finetune the heuristic anymore, or I increase the risk for getting false-negatives.

Is there a point in fine-tuning down to an ideal 0% or do you just say, a certain number of false-positives should be considered ok?

There are two approaches left for me, to further down the number, first being, that I rewrite the CRC calculation and include it in the heuristic search for frame 2. This might increase the time the dissection needs to filter. The second approach is to include a preference, and filter out certain number in a field, because they highly suggest a false-positive. 

Both approaches would complicate the development of openSAFETY device, because you would no longer see false messages which might occur during development.

Has anyone got some ideas here?

regards,
Roland