Patent ID: 7574740
Filing Date: 2009-08-11
Classification: H04L

Abstract:
1. A computer-implemented process for generating an advisory about an intrusion event in a computer network, comprising the steps of: a. monitoring data packets carried by the computer network for a possible intrusion event; b. detecting an intrusion event; c. determining whether the detected intrusion event represents a qualified intrusion event having a known characteristic associated with a recognized attack and a detectable target vulnerability; d. if the detected intrusion event is a qualified intrusion event, then identifying a network target and evaluating whether the network target is vulnerable to the detected intrusion event; e. assigning the detected intrusion event with a ranking based on the vulnerability of the network target, wherein the advisory has the assigned ranking associated with a low priority attack event if the scan fails to identify a vulnerability of the scanned network target to the detected intrusion event; and f. issuing the advisory having the assigned ranking.