We present a method of analysis for evaluating intrusion detection systems. The method can be used to compare the performance of intrusion detectors, to evaluate performance goals for intrusion detectors, and to determine the best configuration of an intrusion detector for a given environment. The method uses a decision analysis that integrates and extends ROC (receiver operating characteristics) and cost analysis methods to provide an expected cost metric. We provide general results and illustrate the method in several numerical examples that cover a range of detectors that meet a performance goal and two actual detectors operating in a realistic environment. We demonstrate that, contrary to common advice, the value of an intrusion detection system and the optimal operation of that system depend not only on the system's ROC curve, but also on cost metrics and the hostility of the operating environment as summarized by the probability of intrusion. Extensions of the method are outlined, and conclusions are drawn.

Article Free Access Share on A general economics model of software reuse Authors: J. E. Gaffney View Profile , R. D. Cruickshank View Profile Authors Info & Claims ICSE '92: Proceedings of the 14th international conference on Software engineeringJune 1992Pages 327–337https://doi.org/10.1145/143062.143150Published:01 June 1992Publication History 24citation984DownloadsMetricsTotal Citations24Total Downloads984Last 12 Months70Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

The software productivity activities in The IEEE Computer Society, the Software Productivity Consortium, and the Software Engineering Institute are addressed. Particular emphasis is placed on the metrics work of the Software Productivity Consortium, which includes the development of definitions of quantifiable aspects of the process and the products it generates and the establishment of means to obtain these quantities, directly or indirectly. A principal focus is on developing economic models of the process which include measures of productivity.>

Definitions of software reliability are presented, and an overview of reliability is given. The system-software-availability relationship is also explored.>

The author quantifies the relative reduction in software development costs provided by the use of a higher order coding language (HOL). Paradoxically, as T. C. Jones (1978) has pointed out, when productivity is measured as source lines of code per labor month, there is `an apparent productivity lowering for the whole development cycle with high level (coding) languages, even though development costs have actually been reduced.' The problem here is the unit of measure for the amount of the software function produced per labor month. It is believed that the amount of machine code produced (after taking compiler inefficiency into account) may provide a better quantification of function than the lines of source coding language used.

This paper provides formulas relating the number of faults or ``bugs'' to the number of lines of code and to the number of conditional jumps. A result is that there are, on the average, about 21 bugs per KSLOC discoverable after successful compilation. A major motivation for the work presented here was to determine if some published data suggest any relationship between the level of the coding language employed (e.g., Jovial is a ``high'' level language) and the number of bugs found. It is shown that the number of bugs appears not to be a function of the ``level'' of the coding language employed. In addition, knowledge of items such as the size of the vocabulary (operator and operand) used appears to be of little consequence to the estimate of bug content beyond that based on SLOC count.

One of the most important problems faced by software developers and users is the prediction of the size of a programming system and its development effort. As an alternative to "size," one might deal with a measure of the "function" that the software is to perform. Albrecht [1] has developed a methodology to estimate the amount of the "function" the software is to perform, in terms of the data it is to use (absorb) and to generate (produce). The "function" is quantified as "function points," essentially, a weighted sum of the numbers of "inputs," "outputs,"master files," and "inquiries" provided to, or generated by, the software. This paper demonstrates the equivalence between Albrecht's external input/output data flow representative of a program (the "function points" metric) and Halstead's [2] "software science" or "software linguistics" model of a program as well as the "soft content" variation of Halstead's model suggested by Gaffney [7].

Abstract—This paper describes the concept of a hardware sequential decision-making device consisting principally of an array or network of nodes which can support a plurality of connections among the nodes on a simultaneous basis. The connection "chains" the nodes together. The application of the device to a dynamic computer memory allocation system is described in the paper. In this use, each "node" would correspond to a word or a group of words in a storage device, the access to which is controlled by a control unit employing the node network. Thus, only one node needs to be selected to either load a record into the controlled memory unit, or to read the record from it.