A quantitative methodology for evaluating and deploying security monitors