Threat-model-driven runtime adaptation and evaluation of intrusion detection system