Patent ID: 7127743
Filing Date: 2006-10-24
Classification: G06F,H04L

Abstract:
1. A computer system for detecting and monitoring network intrusion events from log data received from network service devices in a computer network, the computer system having discrete modules associated with a function performed on the log data received, the computer system comprising: an event parser in communication with multiple network service devices, wherein the network service devices comprise a firewall, VPN (virtual private network) server or router, an e-mail server, or any combination of two or more thereof, the event parser being able to receive log data in real time from the device, the log data including information detailing a network intrusion event received from the network service device if an intrusion has occurred, the event parser being able to parse the information to create corresponding event objects concerning the intrusion events, wherein an event object comprises information fields relevant to network security monitoring including at least information regarding a reporting device and a time stamp; an event manager in communication with the event parser, the event manager being able to receive the event objects, the event manager being configured to evaluate the event objects according to at least one predetermined threshold condition such that, when the event objects satisfy the predetermined threshold condition, the event manager designates the event objects to be broadcast in real time; an event broadcaster in communication with the event manager for receiving event objects designated by the event manager for broadcast, the event broadcaster being able to transmit the event objects in real time, relative to the receipt of the log data, as an intrusion alarm; and means for alerting a user that a network intrusion event has occurred.