Measuring intrusion detection capability: an information-theoretic approach