Characterising intrusion detection sensors
Siraj Ahmed Shaikh, Howard Chivers, Philip Nobles, John A. Clark, Hao Chen · Network Security · 2008
An intrusion detection sensor is defined as a device that collects and analyses network traffic for the purpose of identifying suspicious events. Too often the value of a sensor is associated with its data collection and analysis features. Experience tells us such sensors fall under a range of different types and are diverse in their operational characteristics, some of which have been little studied. In this article, researchers from the Cranfield and York universities examine some of these characteristics, such as location and response, and also characterise the various costs associated with such sensors.