Patent ID: 7730537
Filing Date: 2010-06-01
Classification: G06F,H04L

Abstract:
1. A method of operating an intrusion detection system, said method comprising: monitoring, by the intrusion detection system, for occurrence of a signature event that is indicative of a denial of service intrusion on a protected device, said denial of service intrusion attempting to impede operation of the protected device, wherein the intrusion detection system comprises a signature file and a log, wherein the signature file includes a signature set comprising elements that include a signature set identifier, a signature event, a signature event counter that keeps count of the number of occurrences of the signature event, a signature threshold quantity, and a signature threshold interval, responsive to said monitoring, determining that the signature event occurs, and increasing a value of the signature event counter; adjusting the value of the signature event counter to not include a count of signature events past a sliding window specified by the signature threshold interval; after said determining that the signature event occurs, determining that the value of the signature event counter exceeds the signature threshold quantity; responsive to said determining that the value of the signature event counter exceeds the signature threshold quantity, generating an alert; after said generating the alert, recording in a log a timestamp denoting a time of said generating the alert; after said recording the timestamp in the log, clearing the log of any entries that are past a permissible age; after said clearing the log, determining a present alert generation rate as a ratio of the total number of timestamps in the log to the permissible age; after said determining the present alert generation rate, ascertaining that the present alert generation rate exceeds an alert generation rate threshold; and responsive to said ascertaining, altering a selected element of the elements of the signature set to decrease a rate at which alerts are generated.