Print this page and give the answers.

Name:______________________________     Alpha:________________________________ 
  1. [4pts] Depending how to detect bad behaviors, there are two-different kinds of IDSes.

    _______________________________     _______________________________
  2. [8pts] An IDS is based on the assumption that attacker behavior is (sufficiently) different from legitimate user behavior. However, in reality, there will be an overlap, so it's inevitable that IDSes have false positives and false negatives. Color the appropriate region in each of the pictures as instructed.
    Please, color (or circle) the potential false positive region:

    Please, Color (or circle) the potential false negative region:

  3. [14pts] Consider a following scenario.

    There have been 10,000 events, among which 100 events were actual attacks. Suppose an IDS system that worked as follows:

  4. [5pts] Suppose that there is an IDS system A with the following feature: Suppose that we receive 10,000 requests a day and 100 of them are actual attacks. What is the expected number of false alarms? Show your work.
    
    
    
    
    
    
  5. [10pts] List the three requirements of a reference monitor.
    
      - 
      - 
      -
      
  6. [10pts] Answer the following TRUE/FALSE questions.

  7. [4pts] The descriptions below are from "Security Engineering, 3rd ed". Choose the word from the box that best fits each description.
    Tempora      Prism        NotPetya      Muscular      Bullrun     
    Xkeyscore    Longhorn     Edgehill      DGA           Mirai