Patent ID: 6907430
Filing Date: 2005-06-14
Classification: G06F,H04L

Abstract:
1. A method for processing data from a computer network to determine an occurrence of and characterize a particular activity associated with the computer network, comprising the steps of: managing a collection of data corresponding to events associated with the computer network; establishing at least one model to correlate an occurrence of a predetermined set of events; forming at least one hypothesis, using the at least one model, that characterizes the particular activity associated with the computer network; and evaluating the at least one hypothesis using the at least one model, wherein the steps of forming and evaluating are performed interactively with the step of managing to iteratively update the collection of data, wherein the step of evaluating comprises the steps of: automatically evaluating the collection of data using the at least one model to generate probabilistic assessments of the at least one hypothesis that characterize the particular activities by matching predictions of the at least one model with the collection of data; and automatically evaluating the probabilistic assessments of the at least one hypothesis; automatically providing requirements to the step of managing for updating the collection of data if additional data is required to determine whether the occurrence of the particular activity is an attack associated with the computer network; automatically generating at least one response to counter the particular activity if the particular activity is an attack associated with the computer network.