Patent ID: 7450005

Claim:
A computer implemented method for intrusion detection in a computer environment, the computer implemented method comprising: receiving first configuration information from an intrusion detection skin, wherein the first configuration information identifies a set of one or more analysis approaches to be executed and a weight to apply to each of the one or more analysis approaches, wherein the set of one or more analysis approaches comprises one or more default analysis approaches added through a pluggable analysis module, wherein the one or more default analysis approaches comprise all of a signature-based analysis approach, an anomaly-based analysis approach, a scan-based analysis approach, and a danger theory analysis approach, and wherein the intrusion detection skin defines all of: which filters are to be used to produce the score; what score ratio is to be produced to rate if an intrusion has occurred; assignment of rules on how weights for each analysis approach are to be dynamically adjusted; assignment of rules on how the score is to be dynamically adjusted; interval/frequency in which the set of one or more analysis approaches is to be executed; how to determine false positives and false negatives produced by the set of one or more analysis approaches; how detected intrusions are resolved; where to send reports and errors; and what statistics/metrics to collect on intrusion activity; executing the set of one or more analysis approaches against event information generated by one or more computing elements in the computer environment; determining a score based on one or more policies; determining whether the event information represents an intrusion based on the score; responsive to a determination that the event information represents an intrusion based on the score, determining whether the determination is a false positive; responsive to a predetermined number of false positives, adjusting the weight to apply to each of the one or more default analysis approaches; responsive to a determination that the event information does not represent an intrusion based on the score, determining whether the determination is a false negative; responsive to a predetermined number of false negatives, adjusting the weight to apply to each of the one or more analysis approaches; responsive to a determination that the event information represents an intrusion based on the score, notifying an administrator of the intrusion according to the one or more policies and resolving the intrusion according to the one or more policies; setting a time threshold in the intrusion detection skin; responsive to meeting the time threshold, using an analysis manager to collect data over a time period; and adjusting the weight according to the data.