Strategic monitor placement against malicious flows