This paper proposes a resource-aware allocation model for layered intrusion detection in het erogeneous networks. Monitoring traffic at higher protocol layers improves the ability to detect sophisticated attacks, but it also increases computational and storage costs. The problem is formu lated as an integer linear program that assigns a single monitoring depth, ranging from Ethernet to the application layer, to each device, while accounting for device importance, attack probability, layer-dependent detection rates, and per-layer monitoring costs. The model further enforces a global resource budget, a minimum monitoring level for critical devices, and maximum-feasibility limits for constrained devices such as simple IoT sensors. The formulation is solved with the SCIP optimization framework on a small heterogeneous network of six devices, and the resulting allocation illustrates how the model concentrates monitoring effort on important and high-risk devices while respecting feasibility and budget constraints.

翻译：本文提出了一种面向异构网络的资源感知分层入侵检测分配模型。在更高协议层监控流量可提高检测复杂攻击的能力，但也会增加计算和存储成本。该问题被建模为整数线性规划，为每个设备分配从以太网到应用层的单一监控深度，同时考虑设备重要性、攻击概率、分层检测率以及每层监控成本。该模型进一步约束了全局资源预算、关键设备的最低监控级别，以及简单物联网传感器等受限设备的最大可行性限制。该规划通过SCIP优化框架在包含六个设备的小型异构网络上求解，所得分配结果揭示了模型如何在确保可行性与预算约束的前提下，将监控资源集中用于重要且高风险设备。