2009/07/22 by Thomas Guyet, René Quiniou, Guyet, Thomas +5
Computer Science · #Advanced Malware Detection Techniques #Artificial Intelligence (cs.AI) #FOS: Computer and information sciences #Multiagent Systems (cs.MA) #Network Security and Intrusion Detection #Networking and Internet Architecture (cs.NI) #Spam and Phishing Detection #cs.AI #cs.MA #cs.NI
paper · pdf · doi:10.48550/arxiv.0907.3819
arxiv created 2009/07/22 · openalex publication_date 2009/07/22 · arxiv updated 2009/12/01 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
The evolution of the web server contents and the emergence of new kinds of intrusions make necessary the adaptation of the intrusion detection systems (IDS). Nowadays, the adaptation of the IDS requires manual -- tedious and unreactive -- actions from system administrators. In this paper, we present a self-adaptive intrusion detection system which relies on a set of local model-based diagnosers. The redundancy of diagnoses is exploited, online, by a meta-diagnoser to check the consistency of computed partial diagnoses, and to trigger the adaptation of defective diagnoser models (or signatures) in case of inconsistency. This system is applied to the intrusion detection from a stream of HTTP requests. Our results show that our system 1) detects intrusion occurrences sensitively and precisely, 2) accurately self-adapts diagnoser model, thus improving its detection accuracy.