CSO

I believe there is some potential for access to high-risk category informationt. I had for a few years working for a behavioral-based IPS developer and I can tell you this is very tricky business. It no doubt works best when there is more control over the variables that impact this problem. For example, we had spent an enormous amount of effort on time-based variables associated with an application-layer protocol. Unfortunately when dealing with small delays, Internet network latency became a significant factor that was not observed in out test bed. Sometimes even the application layer creates the problem along with the network. Take Citrix for example, the delays associated this protocol in addition to the network, causes errors, backspaces, rekeying, etc that could appear as someone with a different behavioral profile (e.g., can make an efficient hacker who usually makes few mistakes in manipulating a protocol look like a real noob). So in order to cut down on the false positives (for an IPS these are show stoppers), we made the system less sensitive, thus, increasing the likelihood of false negatives - you know the game. Saying that, I do believe there are some variables that could be used this fourth factor.