Compositional Optimum Network Sensor Utilization System

Currently employed intrusion detection sensor configurations rarely change. This represents a broad, static attack detection domain. Changes within a dynamic environment, due either to policy changes, or changes within the system’s condition, can make certain attacks more important than others. Static scopes will either result in flooding administrators with relatively less important attack reports, or result in the elusion of more important attacks. We present a model which can dynamically incorporate changes within policy and the environment, resulting in autonomic sensor reconfigurations that more accurately detects and reports important attacks within the system.