Patent ID: 7941855
Filing Date: 2011-05-10
Classification: H04L

Abstract:
1. A method of detecting intrusions on at least one computer in a computer network, including the steps of: providing a computer-readable medium encoded with an intrusion detection system, said intrusion detection system comprising a feature ranking algorithm configured to extract features of interest from a network and network activity; a plurality of support vector machines, wherein each of said support vector machines is a kernel-based algorithm configured to analyze extract features of interest to determine whether said extracted features are normal or malicious; using said feature ranking algorithm to extract features of interest from a network and network activity; using said kernel-based algorithm to analyze extracted features of interest to determine if said extracted features are normal or malicious; if said extract features are determined to be malicious, causing said activity to be denied prior to access, terminated after access, limited in scope, honey-potted or tracked; and based on whether said activity is denied prior to access, terminated after access, limited in scope, honey-potted or tracked, determining that an intrusion onto said computer has occurred.