The base-rate fallacy and the difficulty of intrusion detection
An Intrusion-Detection Model