 |
In the detection phase, the functions of the crawler module, the judgment module, and the data processing module are the same as in the training phase. But in the phase, the data processing module will transport data that will be detected to the detection module. And the detection model, wherein the detection module will use detection evidence to detect it. In addition to the detection model, an alarm is also provided in the detection module. If the result of one of the detectors of the detection model is ˇ°may be caused by illegally tamperingˇ±, the alarm will be incremented by one. The detection module will transport alarm value to an alarm module. The alarm module will decide whether to alarm according to a risk value. Finally, if the result is a false positive, the alarm module will return the result to the training module and make it restart. |
IEEE/ICACT20210116 Slide.08
[Big Slide]