Patent ID: 7664950

Claim:
A method for dynamically changing an intrusion detection rule in a kernel level intrusion detection system, the method comprising the steps of: a) generating a replica of a current intrusion detection rule in a kernel area, the current intrusion detection rule being pointed by a current pointer; b) setting a first global variable when changing the replica of the current intrusion detection rule into a new intrusion detection rule, in response to a request from a user area for changing the intrusion detection rule, the replica being pointed by a new pointer; c) setting a second global variable and resetting the first global variable after the replica is changed to indicate to a packet received after step b) that a change to the intrusion detection rule is in process and the packet is to use the new intrusion detection rule; d) resetting the second global variable to indicate that the current pointer is pointing to the new intrusion detection rule while the new pointer is pointing to the current intrusion detection rule; e) changing the current intrusion detection rule pointed to by the new pointer to the new intrusion detection rule after the second global variable is reset; and f) using the new intrusion detection rule on the packet.