Question

Learning from lessons of the Stuxnet incident, the Chief Information Officer (CIO) at ACME Energy Company is trying to improve its information network security at its energy generation facility. The CIO is trying to evaluate a new intrusion detection technology in the market for a possible replacement for the existing system. An intrusion detection system sounds an “alarm” each time possible malicious attack on a network is detected. The following information is provided:

Event of interest, A, is an attack

Evidence, B, is intrusion detection system setting off due to anomalous traffic

Probability of an attack is 0.01

For the currently installed system, the probability of an alarm given that there is an attack is 0.9, while the probability of an alarm given there is no attack is 0.25

For the new technology, the probability of an alarm given that there is an attack is 0.8, while the probability of an alarm given there is no attack is 0.1

The CIO assumes that there are only two types of events: either there is, or there is no attack

The CIO is using “evidence ratio,” described as P(B|A) / P(B|A’) as a way to compare the technologies

Please help the CIO compare the new technology with the currently installed system by answering the following questions:

What is evidence ratio for the currently installed system?        

What is the evidence ratio for the new technology?     

Answer 1