By estimating the cost and the profit, new network configuration variation strategies with better performance are permitted to replace original ones in the table of network configuration variation strategies, which makes EDM more efficient in dealing with the original security threats.