A framework for modular knowledge composition in network intrusion detection systems