Monitoring Operational Activities In Networks And Detecting Potential Network Intrusions And Misuses

An intrusion detection system, comprising:

• a processor;
• and
• a memory in communication with the processor, the memory comprising instructions that, when executed by the processor, cause the processor to perform operations comprising
• collecting logs each of which comprises a plurality of entries;
• extracting information from the logs;
• based upon the information extracted from the logs, updating, on an entry-by-entry basis, intrusion detection information utilized by an intrusion detection rule;
• updating a profile utilized by the intrusion detection rule;
• comparing the profile and the intrusion detection rule against a running state of an on-going session;
• tagging corresponding log entries of the logs with a threat score;
• calculating the threat scores from the corresponding log entries to create an aggregated threat score;
• and
• presenting the aggregated threat score.

A computer-readable storage medium comprising computer-executable instructions that, when executed by a processor, cause the processor to perform operations comprising:

• collecting logs each of which comprises a plurality of entries;
• extracting information from the logs;
• based upon the information extracted from the logs, updating, on an entry-by-entry basis, intrusion detection information utilized by an intrusion detection rule;
• updating a profile utilized by the intrusion detection rule;
• comparing the profile and the intrusion detection rule against a running state of an on-going session;
• tagging corresponding log entries of the logs with a threat score;
• calculating the threat scores from the corresponding log entries to create an aggregated threat score;
• determining if an alarm condition has been satisfied by the aggregated threat score;
• and
• if the alarm condition has been satisfied by the aggregated threat score, presenting an alarm.