Re: Intrusion Detection Evaluation Datasets

Damiano Bolzoni wrote:

signature-based IDS) use regular a regular expression
you can only state that an expression must not occur at all, could
occur, can occur once or more, or it can occur a number of times (but
you cannot say how many times exactly).

Can you think of an instance of attack where detecting this is important ?