Patent ID: 8185955

Claim:
A computer implemented method of detecting intrusions in a system under surveillance, wherein said intrusions are detected, using a computer, by analyzing events occurring during operation of said system under surveillance by matching said events against a knowledge base comprising information on events which occurred during a learning phase, the method comprising: recording, using a computer, during said learning phase, temporal data that includes a timestamp corresponding to when a specific system resource was used relating to said events which occurred during said learning phase, said learning phase occurring at a different time from an analysis phase; identifying, using a computer, a dynamic part of said knowledge base as a function of said temporal data, wherein said dynamic part includes a list of system resources whose temporal data indicate that use of said system resources is below a predetermined threshold level of use during said learning phase; discovering, using a computer, patterns that cover said dynamic part of the knowledge base; and performing, using a computer, during said analysis phase, a regular expression match at least with respect to said dynamic part of the knowledge base.