Patent ID: 7096498

Claim:
A method for managing threat information, the method comprising the steps of: a. receiving threat information from one or more sources selected from the group consisting of application layer security systems, spain databases, a virus information databases, and intrusion information databases; b. reducing the received threat information into a canonical form; c. extracting features from the reduced threat information by applying one or more regular expressions; d. selecting a goal set of one or more threat management goals based at least in part upon a selected application layer security system from the plurality of application layer security systems, wherein the goal set comprises one or more values of a type selected from the group of effectiveness values, accuracy values, efficiency values and false positive values; e. generating a candidate rule set of one or more threat rules based upon the extracted features and the goal set; f. testing the candidate rule set against one or more sets of test data; g. refining the candidate rule set if the evaluation of the rule set fails to satisfy a predetermined confidence level; and h. transmitting the candidate or refined rule set to at least one application layer security system.