Patent ID: 7036148
Filing Date: 2006-04-25
Classification: G06F,H04L

Abstract:
1. A method of operating an intrusion detection system for detecting an intrusion of a protected network attachment according to at least one business rule, said method comprising the steps of: awaiting an occurrence of a next update time of the intrusion detection system, said next update time being a time at which at least one validity condition of the at least one business rule is checked; responsive to the occurrence of the next update time, checking the at least one validity condition of the at least one business rule to determine whether a provision of any business rule of the at least one business rule is a newly operative provision that has first become operative or gone into effect since an occurrence of a last previous update time at which the at least one validity condition of the at least one business rule was checked, said newly operative provision prescribing an alteration of an intrusion set that the provision applies to; if the checked provision is the newly operative provision that applies to the intrusion set, then altering the intrusion set according to the newly operative provision.