Patent ID: 8006302

Claim:
An intrusion detection system, for detecting unauthorised use of a network, comprising: at least one computer; a database storing attack signatures and, for each of the attack signatures, a set of at least one corresponding response signature; and a non-transitory computer readable medium encoded with a computer program product loadable into a memory of the at least one computer, the computer program product including: instructions for a sniffer for capturing data being transmitted on said network, instructions for a pattern matching engine for comparing the captured data with the attack signatures for generating an event when a match between the captured data and at least one attack signature is found, and instructions for a response analysis engine triggered by said event, for selecting, from the database, a selected set of at least one response signature corresponding to the at least one matched attack signature, and comparing, with the selected set of at least one response signature, response data being transmitted on said network as a response to said captured data and for correlating results of said comparisons with attack and response signatures for generating an alarm.