Patent ID: 7043755

Claim:
A high-performance specification resolution method for use in detecting attacks against computer systems, comprising: a) receiving audit conditions to be detected using non-limiting specification formulas expressing fraudulent entry or attack patterns or abnormal operations, to be verified by examining records of a log file of a computer system; b) expanding said formulas into subformulas for each record; c) scanning and generating, for each expanded formula, Horn clauses to resolve in order to detect whether or not the formula is valid for each record, the Horn clauses expressing implications resolvent of the subformulas for each record scanned in positive clauses having a positive literal and in negative clauses having at least one negative literal; d) storing the positive clauses in a stack of subformulas, storing, in a table of clauses, a representation of the negative clauses and the positive clauses; storing, in a table of counters, a number of negative literals in each negative clause; e) resolving the table of clauses based on each positive clause so as to generate either an output file or an action of the computer system; f) iterating steps b) through e) until the scanning of all the records in the log file is complete.