The model is based on Colored Petri Nets.
Guards define the context in which signatures are matched.
The notion of start and final states, and paths between them define the set of event sequences matched by the net. Partial order matching can also be specified in this model. The main benefits of the model are its generality, portability and flexibility. 1 Introduction Computer break-ins are becoming increasingly frequent and their detection is increasingly important. Break-ins make the data residing on computer systems vulnerable to theft and corruption.