From threat intelligence to decision theory
A Network Intrusion Detection System (NIDS) watches network traffic and decides whether what it sees is ordinary activity or an attack. Modern systems learn that decision from labeled examples and routinely report accuracies above 99 percent. That number does not answer the question a defender actually faces, which is...