Patent ID: 8191139

Claim:
A method of correlating and analyzing reports of detected activity in a computer network, the method comprising: receiving and storing intrusion reports from multiple intrusion detectors, each intrusion detector operable to provide a report in a standard canonical format; clustering the intrusion reports with one or more explanations for associated intrusion reports in a sensor concentrator operable to assign a single intrusion report to more than one explanation, assign a plurality of intrusion reports to a single explanation, and, when no existing explanation supports a plausible cause, hypothesize a new explanation; and scoring, by a microprocessor, the events one or more explanations for the associated intrusion reports as a function of qualitative probability at an analyzer based on an intrusion reference model that contains information about a protected network, its configuration, installed intrusion detectors, and related security goals, wherein the one or more explanations for the associated intrusion reports are weighed against each other using a calculus based on qualitative probability.