Patent ID: 6996843

Claim:
A system for detecting intrusion on a host, comprising: a) a source of rules; b) a source of facts; and c) an analysis engine executed on a processor in communication with the source of rules and source of facts, configured to determine whether an intrusion has taken place by applying forward- and backward-chaining using facts from the source of facts and rules from the source of rules by: (i) using forward chaining to generate one or more inferences: (ii) determining which, if any, of the inferences matches a sub-goal associated with a rule from the source of rules; (iii) with respect to each inference that matches a sub-goal, applying backward chaining from that sub-goal's potential parents into other sub-goals; and (iv) for each sub-goal reached either by forward or backward chaining, determining whether the sub-goal indicates an intrusion has taken place, wherein the analysis engine is further configured to use continuations to schedule the processing of a goal based at least in part on whether the data required to continue processing the goal is available and based at least in part on a subdivision of rules into segments which each become a rule.