Developing expertise for network intrusion detection

摘要: Purpose – The paper seeks to provide a foundational understanding of the socio‐technical system that is computer network intrusion detection, including nature knowledge work, situated expertise, and processes learning as supported by information technology.Design/methodology/approach authors conducted field study explore work detection using multiple data collection methods, semi‐structured interviews, examination security tools resources, analysis mailing list posts, attendance at several domain‐specific user group meetings.Findings practice analysts involves both domain expertise networking high degree problem‐solving activities are not predefined evolve with dynamically changing context analyst's environment. This highlights process needed acquire these two types knowledge, c...