Intrusion detection report correlator and analyzer

An intrusion detection system comprising:

• means for receiving and storing intrusion reports from multiple intrusion detectors;
• means for clustering the intrusion reports and associating them with events;
• and
• means for scoring the events based on an intrusion reference model.

A dynamic evidence aggregator for an intrusion detection system, the dynamic evidence aggregator comprising:

• an input that receives and stores intrusion reports from multiple intrusion detectors;
• a first module that clusters the intrusion reports into events;
• and
• a second module that scores the events based on an intrusion reference model.

An intrusion detection system comprising:

• an input that receives and stores intrusion reports from multiple intrusion detectors;
• a first module that clusters the intrusion reports into events;
• an intrusion reference model;
• and
• a second module that scores the events based on the intrusion reference model.