Patent ID: 7260846

Claim:
An intrusion detection system (IDS) comprising: a traffic sniffer executing in a computing system for extracting network packets from passing network traffic; a traffic parser executing in a computing system configured to extract individual data from defined packet fields of said network packets; a traffic logger executing in a computing system configured to store individual packet fields of said network packets in a database; a vector builder executing in a computing system configured to generate multi-dimensional vectors from selected features of said stored packet fields; at least one self-organizing clustering module executing in a computing system configured to process said multi-dimensional vectors to produce a self-organized map of clusters; an anomaly detector executing in a computing system able to detect anomalous correlations between individual ones of said clusters in said self-organized map based upon at least one configurable correlation metric; and a classifier executing in a computing system configured to classify detected anomalous correlations as one of an alarm behavior.