John McHugh

John McHugh is a computer-security researcher whose work includes intrusion detection and the evaluation of detection systems. His scholarship examined not only how systems identify suspicious activity but also how claims about detector performance should be tested.

Testing the tests

In a 2000 ACM Transactions on Information and System Security article, McHugh analyzed the 1998 and 1999 DARPA intrusion-detection evaluations performed by Lincoln Laboratory. The critique focused attention on experimental design and the limits of benchmark-driven conclusions.

Security practice

McHugh also contributed to Carnegie Mellon University's Software Engineering Institute work documenting the state of intrusion-detection technologies. That work placed research questions alongside the realities of deployed security products.

Timeline

• 2000Coauthors an SEI report on the state of intrusion-detection technologies.
• 2000Publishes a critique of the 1998 and 1999 DARPA intrusion-detection evaluations.
• 2004Teaches an intrusion-detection module in Carnegie Mellon security coursework.