Toward interface customization in intrusion detection systems

Intrusion detection systems offer a new challenge for intelligent user interfaces research. IDSs commonly identify tens of thousands of alerts that may indicate intrusions over a computer network. In a system that we are currently building, the user constructs hypotheses concerning actual attacks and attempts to verify these hypotheses via knowledge embedded in the system and information external to the system. Behavior-based customization holds some promise to alleviate the difficulty users face in this task.