Patent ID: 7904960

Claim:
A method of intrusion detection system (IDS) virtualization, comprising: receiving a stream of packets; fingerprinting each packet in the stream to identify at least one target operating system type, wherein the at least one target operating system type is an operating system of a destination host for each corresponding packet; directing each packet to a virtual IDS process associated with the operating system of the destination host identified for each corresponding packet; comparing each packet to a threat signature set corresponding to each identified operating system of the destination host in the virtual IDS process; a accepting each packet based on comparing each packet to the threat signature set; forming a reduced threat signature set from a received collection of threat signatures, the reduced threat signature set corresponding to a specific target operating system; forming the virtual IDS process from the reduced threat signature set corresponding to the specific target operating system; forming a common reduced threat signature set from a received collection of threat signatures, the common reduced threat signature set being common to at least two target operating systems; and forming a common virtual IDS process from the common reduced threat signature set corresponding to the at least two target operating systems; wherein directing each packet to the virtual IDS process associated with the operating system of the destination host identified for each corresponding packet comprises: directing at least one packet of the stream of packets to the virtual IDS process associated with the operating system of the destination host identified for the at least one packet; and directing the at least one packet to the common virtual IDS process when the common virtual IDS process is associated with the operating system of the destination host identified for the at least one packet, the virtual IDS process and the common virtual IDS process providing parallel and substantially simultaneous processing of the at least one packet.