The Configuration and Waiting Time Policies for Intrusion Detection Systems

Abstract

Intrusion Detection Systems (IDSs) is one of the widely used detective control mechanisms. In this paper, we consider both configuration and waiting time decision in order to design appropriate policies for responding signals generated by IDS. We analyze both myopic configuration policy that minimizes the expected cost in current period and optimal configuration policy that considers expected cost in the current and future periods. These policies are compared with myopic and optimal waiting time policies with fixed configuration. Our results show that myopic configuration and optimal configuration policies reduce cost significantly.