PRIVATE-LEARNED IDS
First Claim
1. A method comprising:
- maintaining, by a device in a network, a plurality of machine learning-based detectors for an intrusion detection system, wherein each detector is associated with a different portion of a feature space of traffic characteristics assessed by the intrusion detection system;
providing, by the device, data regarding the plurality of detectors to a user interface;
receiving, at the device, an adjustment instruction from the user interface based on the data provided to the user interface regarding the plurality of detectors; and
adjusting, by the device, the portions of the feature space associated with the plurality of detectors based on the adjustment instruction received from the user interface.
1 Assignment
0 Petitions
Accused Products
Abstract
In one embodiment, a device in a network maintains a plurality of machine learning-based detectors for an intrusion detection system. Each detector is associated with a different portion of a feature space of traffic characteristics assessed by the intrusion detection system. The device provides data regarding the plurality of detectors to a user interface. The device receives an adjustment instruction from the user interface based on the data provided to the user interface regarding the plurality of detectors. The device adjusts the portions of the feature space associated with the plurality of detectors based on the adjustment instruction received from the user interface.
26 Citations
20 Claims
-
1. A method comprising:
-
maintaining, by a device in a network, a plurality of machine learning-based detectors for an intrusion detection system, wherein each detector is associated with a different portion of a feature space of traffic characteristics assessed by the intrusion detection system; providing, by the device, data regarding the plurality of detectors to a user interface; receiving, at the device, an adjustment instruction from the user interface based on the data provided to the user interface regarding the plurality of detectors; and adjusting, by the device, the portions of the feature space associated with the plurality of detectors based on the adjustment instruction received from the user interface. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. An apparatus comprising:
-
one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to; maintain a plurality of machine learning-based detectors for an intrusion detection system, wherein each detector is associated with a different portion of a feature space of traffic characteristics assessed by the intrusion detection system; provide data regarding the plurality of detectors to a user interface; receive an adjustment instruction from the user interface based on the data provided to the user interface regarding the plurality of detectors; and adjust the portions of the feature space associated with the plurality of detectors based on the adjustment instruction received from the user interface. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A tangible, non-transitory, computer-readable medium having software encoded thereon, the software when executed by a device in a network configured to:
-
maintaining, by the device in the network, a plurality of machine learning-based detectors for an intrusion detection system, wherein each detector is associated with a different portion of a feature space of traffic characteristics assessed by the intrusion detection system; providing, by the device, data regarding the plurality of detectors to a user interface; receiving, at the device, an adjustment instruction from the user interface based on the data provided to the user interface regarding the plurality of detectors; and adjusting, by the device, the portions of the feature space associated with the plurality of detectors based on the adjustment instruction received from the user interface.
-
Specification