Patent ID: 7065657

Claim:
A system for detecting intrusions, comprising: an analysis engine; and at least one sensor, configured to communicate with the analysis engine using at least one meta-protocol under which a 4-tuple is used to represent a data item to be sent to the analysis engine for analysis; wherein the 4-tuple comprises a semantic type, data type, data type size, and value of the data item and represents the data item in a manner that enables the analysis engine to receive and use the data item regardless of how the data item is represented and organized on a platform associated with the sensor; wherein the at least one sensor is configured to communicate with the analysis engine using a plurality of meta-protocols; wherein each of the plurality of meta-protocols includes a said 4-tuple; wherein the analysis engine is configured to invoke the at least one sensor and specify a set of meta-protocols supported by the analysis engine, and wherein the at least one sensor is configured to select a meta-protocol from the set; wherein the analysis engine is configured to load a rule set while the analysis engine is in operation.