Principled reasoning and practical applications of alert fusion in intrusion detection systems