Patent ID: 7464158
Filing Date: 2008-12-09
Classification: G06F

Abstract:
1. A method in a computer system for detecting intrusions during a bootstrapping phase of an intrusion detection system, the method comprising: storing a behavior profile associated with an application, the behavior profile having been generated, prior to operation of the application on the computer system that detects intrusions during a bootstrapping phase of an intrusion detection system, by any one of: a combination of executing the system on the reference computer system and heuristic determination, and wherein the stored behavior profile is at least one of encrypted and digitally signed; reading, with the computer system during a bootstrapping phase of an intrusion detection system, the stored behavior profile associated with the application; monitoring execution of the application at the computer system during the bootstrapping phase, according to the behavior profile; and if the behavior of the application does not conform to the behavior profile, issuing a message indicating that the application is not conforming to the behavior profile.