To further limit the processor utilization, small expert
knowledge can be loaded into the LES. Smaller expert knowledge
will require less processing to evaluate and this will
correspond to lower processor utilization across the system.
Using this method, we sacrifice versatility in detecting various
attacks in favour of lower processor utilization. Of course, the
expert knowledge used in each application would be chosen
based on the capability of the hardware