Method and apparatus for an intruder detection reporting and response system

A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and an intruder sensor operating on a client, said method comprising the steps of:

• monitoring a plurality of operations on the client by the intruder sensor;
• determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing the client;
• and
• transmitting a trap message to an event correlation engine, said trap message indicating that said suspected intruder is accessing the client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.

A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and a plurality of client computers with intruder sensors, said method comprising the steps of:

• monitoring a plurality of operations on at least one of said plurality of client computers;
• determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing at least one of said plurality of client computers;
• transmitting a trap message by the intruder sensor to an event correlation engine, said trap message indicating the presence of said suspected intruder on the client computer and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter;
• receiving the trap message by the event correlation engine;
• determining whether said suspected intruder is accessing the client computer;
• and
• if said suspected intruder is detected, transmitting a status change from said event correlation engine to said plurality of client computers, said status change informing said plurality of clients of the location of said suspected intruder.

A distributed system for passively detecting and reporting the presence of an intruder, comprising:

• an event correlation engine with a plurality of associated client computers;
• an associated server computer;
• and
• an intruder sensor operating in the background on said client computers that monitors a plurality of operations and transmitting a trap message to the associated server computer whenever said plurality of operations indicates the presence of a suspected intruder on the client, wherein said trap message includes client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter,
• said server computer including a component for transmitting a status change to said plurality of client computers for informing said plurality of clients of the location of said suspected intruder.

A system for passively detecting and reporting the presence of an intruder on a computer network containing an event correlation engine and a plurality of client computers with intruder sensors, the system comprising:

• means for monitoring a plurality of operations on at least one of said plurality of client computers;
• means for determining whether at least one of said plurality of operations indicates that an intruder is accessing at least one of said plurality of client computers;
• means for transmitting a trap message by the intruder sensor to an event correlation engine, said trap message indicating the presence of a suspected intruder on the client computer and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter;
• means for receiving the trap message by the event correlation engine;
• means for determining that an intruder is accessing the client computer;
• and
• means for transmitting a status change from said event correlation engine to said plurality of client computers, said status change informing said plurality of clients of the location of said intruder.

A method for passively detecting and reporting the presence of an intruder on a computer network comprising an event correlation engine and an intruder sensor operating on a client, said method comprising the steps of:

• monitoring a plurality of operations on the client by the intruder sensor;
• determining whether at least one of said plurality of operations indicates that a suspected intruder is accessing the client;
• and
• transmitting a trap message to an event correlation engine, said trap message indicating that said suspected intruder is accessing the client and including client identifier information, a time stamp, and an object identifier specifying a transmitted parameter and a data portion including a value of the parameter.