This question is for anomaly detection in IDS. Suppose Alice's computer has 2 files (not realistic but for easy calculation...), and here are the rates she accesses them over time:
F1 = 0.45;
F2 = 0.55.
Suppose ∑n=12(Fn−An)2<0.32 means normal.
Help Trudy to pretend to be Alice.
(1 pts) Give an example of A1 and A2 that won't trigger an alarm and verify it.
(2 pts) How much to differ on average for each file at the maximum so that it won't trigger an alarm while "working" towards Trudy's desired frequency? Remember to show your calculations (i.e., the equation you used).
