Patent ID: 7954160

Claim:
In a remote, on-demand computing service environment in which one or more data processing hosts are made available to a remote on-demand user that does not have physical custody and control over said host(s), an intrusion detection system, comprising: means for monitoring resources defined by said on-demand user for intrusion events defined by said on-demand user; said monitoring being performed by one or more intrusion detection agents that are run by said one or more data processing hosts, each intrusion detection agent being associated with a single one of said data processing hosts, and each of said data processing hosts that is being monitored running at least one of said intrusion detection agents; said user-defined resources including hardware resources, non-network system software resources, non-network, local login system access resources and network access resources; said user-defined intrusion events including hardware events, non-network system software events, non-network, local login system access events and network access events; means for implementing responses to said intrusion events according to event-action rules defined by said on-demand user; said user-defined event-action rules including notifying said on-demand user of said user-defined intrusion events; and said intrusion detection system being operable to receive a specification of said resources, said intrusion events and said event-action rules from said on-demand user as security criteria to an on-demand service provider implementing said on-demand computing environment.