Mitigating Log Poisoning Attack against Anomaly-based Intrusion Detection System

12 Oct 2026
Log anomaly detection, Log poisoning attack, Mitigation

Abstract

Anomaly and Intrusion Detection Systems are threatened by poisoning attacks that alter the behaviour of classifiers. Poisoning attacks carefully corrupt training samples and the learnt model, thereby rendering the detection ineffective. To mitigate poisoning attacks, we propose an ensemble learning method that trains several classifiers on distinct portions of the training set. At runtime, the detection system aggregates the classification results. Our theoretical analysis shows that detection is robust to poisoning attacks, when the number of poisoned samples is bounded, which is the case in practice to keep the attacks stealth. To support empirical evaluations of the robustness, we designed and implemented several types of poisoning attacks and developed a prototype. Evaluations show that our mitigation approach significantly improves the robustness and accuracy of the detection system compared to vanilla detection systems.

Citation

Alexandre Azor, Francoise Sailhan, Alexandre Reiffers-Masson, Julien Francq. Mitigating Log Poisoning Attack against Anomaly-based Intrusion Detection System. Information Security Conference 2026, Guillaume Hiet, Oct 2026, Rennes, France.

To read the paper : https://isc2026.github.io/papers/paper_3572.pdf