DEPLOIEMENT D’UN SYSTEME DE DETECTION D’INTRUSION TEMPS REEL DANS LES JOURNAUX DEDIES

Abstract

The deployment of a real-time intrusion detection system (IDS) based on log analysis addresses the limitations of classical batch-processing solutions. This study proposes a modular streaming architecture that ensures the continuous collection, normalization, and analysis of heterogeneous data. Unlike existing work, which typically focuses on isolated aspects such as visualization, performance, or modeling, this study introduces a Trust Pipeline in which data integrity is verified prior to analysis, thereby eliminating the risk of log poisoning. This approach combines integrity mechanisms (SHA-256), flow control, and multi-event correlation. Experimental results on a dataset of 1,000 simulated logs demonstrate robust performance, with a detection rate of 90% and a false positive rate of only 10%. The system successfully reclassifies 75% of suspicious events as non-critical through temporal analysis, confirming the effectiveness of the proposed correlation model for system monitoring.