From what I understand it works like this:
Each host has a patrol IC and potentially one or more spiders. Once hacker presenced is detected via matrix perception the host begins deploying IC at a rate of one per combat round, up to the maximum allowed for that host. IC are deployed in strategic order based on what the host designed wishes to accomplish. Sparky or Black IC could come quickly in a hardcore host, or not at all in most hosts. IC selection can be used to boot users or kill users. You can also use data bombs on files, which must be detected via matrix perception. You can encrypt files, which require decryption.