In particular, the analyst needs to know in real-time that an intrusion has occurred so that an active response and recovery thread can be created rapidly.
Quick recovery is only possible if the assessment scheme has low latency and it occurs in real-time.
The objective of this paper is to develop a reasoning framework to aid in the real-time detection and assessment task that is based on a novel idea of encapsulation of owner s intent. This reasoning is significant in view of the fact that intrusion signaling is not a binary decision unlike error detection in traditional fault tolerance. Our reasoning framework has been developed by leveraging the concepts of cost analysis and pricing under uncertainty found in economics and finance. Our main result is the modeling of user activity on a computing system as a martingale and the subsequent quantification of the cost of performing a job to enable decision making.