Patent ID: 8201249

Claim:
A computer-implemented system for detecting intrusion and misuse of a computer in a computer network including a security server, the system comprising: a processor; and a memory coupled to the processor, the memory storing machine instructions comprising the following routines: an agent manager that directs actions of software agents to collect computer performance parameters from the computer; a data analyzer that summarizes the collected computer performance parameters and generates a user profile, wherein the user profile comprises a local version stored on the computer and a network version stored on the security server; and a comparator that compares additional computer performance data and the user profile and generates a prompt based on one or more criteria related to the computer performance data and the user profile, wherein the prompt provides suggested actions for subsequent operation of the computer to minimize harm to the computer network, wherein the comparator further compares the local version of the user profile and the network version of the user profile, and a difference of greater than 10% between one or more pairs of corresponding values in the local version and the network version indicates a possible intrusion or misuse.