Cyber attack on the Internet has become a problem in recent years, and it has been becoming more sophisticated and complicated. As one of schemes to detect cyber attack, IDS has been widely used. IDS can detect cyber attack based on the signature which is the pattern of cyber attack and so on. There are signature-based and anomaly-based detection methods in terms of IDS. Signature detection compares activity and behavior to signatures of known attacks. Signatures need to be updated regularly to detect a new type of attacks. This paper considers extended stochastic models for a server system with signature update. The server has the function of IDS. In this model, we consider type II error where IDS judges the occurrence of cyber attack erroneously when it occurs. We assume that the check with signature update is performed at Nth check or every k checks. We obtain the expected costs until cyber attack is detected and discuss the optimal policies which minimize them. Finally, numerical examples are given.
