Patent ID: 9641542
Date: 2017-05-02
CPC Classifications: H04L

Claim:
1. A method, comprising: receiving, at a device in a network, information regarding one or more attack detection service level agreements for a voting mechanism between attack detection classifiers and used to detect a network attack, wherein the one or more attack detection service level agreements comprise at least one of: a recall threshold for the voting mechanism, a precision threshold for the voting mechanism, or a false positive rate for the voting mechanism; identifying, by the device, a set of attack detection classifiers executed by one or more nodes in the network as potential voters in the voting mechanism used to detect a network attack; determining, by the device, one or more parameters for the voting mechanism based on the information regarding the one or more attack detection service level agreements; adjusting, by the device, the voting mechanism used by the potential voters based on the one or more parameters for the voting mechanism; and determining, by the device, whether the one or more attack detection service level agreements have been met by the adjusted voting mechanism.