Intrusion detection system

A computer program product, the computer program product comprising:

• one or more computer-readable storage devices and program instructions stored on at least one of the one or more computer-readable storage devices for execution by at least one or more computer processors of a computer system, the program instructions, when executed by the at least one of the one or more computer processors, causing the computer system to perform a method for classification of suspicious activities by a first intrusion detection system, wherein the computer system comprises the first intrusion detection system which is connected to a second intrusion detection system by a first communications connection, and wherein the first intrusion detection system comprises a normal operation mode by which the first intrusion detection system is implemented in:
• receiving first data from one or more honeypot systems and second data from the second intrusion detection system;
• generating a prediction model for representing malicious attacks, wherein the prediction model is generated by execution of a predefined classification algorithm with respect to the received data;
• determining a model evaluation metric with respect to the prediction model;
• and
• deploying the prediction model for use in detecting the malicious attacks, wherein the prediction model is deployed if the model evaluation metric meets a predefined validation condition, and wherein the malicious attacks are detected based on the classification of suspicious activities;
• wherein the method for classification of suspicious activities comprises:
• in response to detecting a malfunction of the first communications connection, switching the first intrusion detection system from the normal operation mode to a limited operation mode;
• updating the predefined validation condition based on the amount of the received data after the malfunction is detected;
• executing the predefined classification algorithm with respect to the received data as received after the malfunction is detected to update the prediction model;
• determining the model evaluation metric with respect to the updated prediction model;
• deploying the updated prediction model for use in detecting the malicious attacks, wherein the updated prediction model is deployed if the model evaluation metric meets the updated predefined validation condition;
• repeating the execution of the predefined classification algorithm to repeatedly update the prediction model;
• repeating the deployment of the repeatedly updated prediction model until the malfunctioning first communications connection is recovered;
• in response to detecting the recovery of the first communications connection, deploying the most recently updated prediction model or a combined model for use in detecting the malicious attacks, wherein the combined model is comprised of the most recently updated prediction model and the generated prediction model;
• and switching the first intrusion detection system from the limited operation mode back to the normal operation mode.

A computer system for classification of suspicious activities, the computer system comprising a first intrusion detection system, wherein the first intrusion detection system is connected to a second intrusion detection system by a first communications connection, and wherein the first intrusion detection system comprises a normal operation mode by which the first intrusion detection system is implemented in:

• receiving first data from one or more honeypot systems and second data from the second intrusion detection system;
• generating a prediction model for representing malicious attacks, wherein the prediction model is generated by execution of a predefined classification algorithm with respect to the received data;
• determining a model evaluation metric with respect to the prediction model;
• and
• deploying the prediction model for use in detecting the malicious attacks, wherein the prediction model is deployed if the model evaluation metric meets a predefined validation condition, and wherein the malicious attacks are detected based on the classification of suspicious activities;
• wherein the classification of suspicious activities comprises:
• in response to detecting a malfunction of the first communications connection, switching the first intrusion detection system from the normal operation mode to a limited operation mode;
• updating the predefined validation condition based on the amount of the received data after the malfunction is detected;
• executing the predefined classification algorithm with respect to the received data as received after the malfunction is detected to update the prediction model;
• determining the model evaluation metric with respect to the updated prediction model;
• deploying the updated prediction model for use in detecting the malicious attacks, wherein the updated prediction model is deployed if the model evaluation metric meets the updated predefined validation condition;
• repeating the execution of the predefined classification algorithm to repeatedly update the prediction model;
• repeating the deployment of the repeatedly updated prediction model until the malfunctioning first communications connection is recovered;
• and
• in response to detecting the recovery of the first communications connection, deploying the most recently updated prediction model or a combined model for use in detecting the malicious attacks, wherein the combined model is comprised of the most recently updated prediction model and the generated prediction model;
• and switching the first intrusion detection system from the limited operation mode back to the normal operation mode.