SYSTEM AND METHODS FOR ADAPTIVE MODEL GENERATION FOR DETECTING INTRUSION IN COMPUTER SYSTEMS

摘要

A system and methods for detecting intrusions in the operation of a computer system comprises a sensor configured to gather information regarding the operation of the computer system, to format the information in a data record t, and to transmit the data. A database is configured to receive the data record from the sensor and to store the data record. A detection model generator is configured to request training data from data record, generate an intrusion detection model based on said training data, and to transmit the intrusion detection model to the data warehouse according to the predetermined data format. A detector is configured to receive a data record from the sensor and to determine whether said data record corresponds to an attack based on said intrusion detection model.