1. A processor-implemented method for selecting an operating point of an intrusion detection system in a computer, the method comprising: determining a true positive rate for the intrusion detection system at each of a plurality of possible vectors of sensor output values; determining a false positive rate for the intrusion detection system at each of a plurality of possible vectors of sensor output values; calculating a ratio of the true positive rate to the false positive rate of the intrusion detection system at each possible vector of sensor output values; sorting by the ratio of the true positive rate to the false positive rate; placing sorted sensor combinations in an output set, wherein the output set represents a convex hull set of non-dominated operating points of the intrusion detection system; selecting a first operating point from the output set for operating the intrusion detection system; selecting a second operating point from the output set; operating the intrusion detection system at the first operating point for a first predetermined amount of time; and operating the intrusion detection system at the second operating point for a second predetermined amount of time.