An Achilles' Heel in Signature-Based IDS: Squealing False Positives in SNORT
The base-rate fallacy and the difficulty of intrusion detection