Realistic expectations for intrusion detection systems