The vast majority of security professionals would agree
that real-time ID systems are not technically advanced
enough to detect sophisticated cyberattacks by trained
professionals. For example, during the Langley cyberattack
the ID systems failed to detect substantial volumes
of email bombs that crashed critical email
servers. Coordinated efforts from various international
locations were observed as hackers worked to understand
the rules-based filter used in counterinformation
operations against massive email bomb attacks [1].
At the other end of the technical spectrum, false
alarms from ID systems are problematic, persistent,
and preponderant. Numerous systems administrators
have been the subject of an ID system reporting normal
work activities as hostile actions. These types of
false alarms result in financial losses to organizations
when technical resources are denied access to computer
systems or security resources are misdirected to
investigate nonintrusion events. In addition, when
systems are prone to false alarms, user confidence is
marginalized and misused systems are poorly maintained
and underutilized.