The Vantage Point Problem


A passive network monitor cannot predict end host behaviour

Even when behaviour is evident, processing overhead may present DoS conditions

Attackers can leverage ambiguity and / or resource limits to evade detection