Patent ID: 9401924
Filing Date: 2016-07-26
CPC Classification: H04L

Claim Text:
1. A method, comprising: collecting, by an intrusion detection system comprising a processor, logs from an authentication, authorization, and accounting logs data store, wherein each of the logs comprises a plurality of entries corresponding with a networking device; extracting, by the intrusion detection system, information from the logs; based upon the information extracted from the logs, updating, by the intrusion detection system, on an entry-by-entry basis, intrusion detection information utilized by an intrusion detection rule, wherein the intrusion detection rule comprises updating, by the intrusion detection system, a profile utilized by the intrusion detection rule; comparing, by the intrusion detection system, the profile and the intrusion detection rule against a running state of an on-going session; tagging, by the intrusion detection system, corresponding log entries of the logs with a threat score; calculating, by the intrusion detection system, the threat score from each of the corresponding log entries to create an aggregated threat score; and presenting, by the intrusion detection system, the aggregated threat score.