This paper proposes methods by which traditionally passive intrusion detection sensors can be instrumented to take certain tactical actions in order to increase the certainty by which they can make decisions. Examples show how a sensor can request injection of additional data into the event data stream it is monitoring, as a reaction to its observation of incomplete indications of threats. As the threat level increases, the sensor could increase its degree of activeness and thereby its visibility. When a system is under attack, an accurate and timely situation assessment enabling effective countermeasures is probably more important to system survivability than keeping the sensors concealed.

• Inquisitive-Sensor-2001.pdf