I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application.
I think there is some value in using AppSensor to detect generic, automated attacks. However, AppSensor seems less valuable against attacks directed at this application because anyone could run the application locally to understand how their attacks would be detected.
Is it worth fully following OWASP AppSensor for an open source web application, or would it be a more efficient use of time and effort to only try to detect automated attacks?