Patent ID: 8893273

Claim:
A system for detecting intrusions in the operation of a computer system comprising: (a) a plurality of sensors, each sensor configured to gather information regarding the operation of the computer system, to format the information in a data record, and to transmit the data record; (b) a data warehouse including at least a specially-programmed processor configured to receive the data record from the sensor, to store the data record in a database, and to store an intrusion detection model; (c) a detection model generator configured to request training data from a plurality of data records from the data warehouse, said training data comprising data collected from at least two sensors, to generate the intrusion detection model based on said training data from a plurality of data records, and to transmit the intrusion detection model to the data warehouse; (d) a detector configured to receive a data record from the sensor and to classify the data record in real-time as one of normal operation and an attack based on said intrusion detection model; (e) a data analysis engine including at least a specially-programmed processor configured to request data records from the data warehouse and to perform a data processing function on the data records; (f) a detection model generator configured to update the intrusion detection model in real-time; (g) a detection model distributor configured to receive said intrusion detection model from the data warehouse and to transmit the detection model to at least one detector; (h) a forensics analysis engine configured to retrieve a set of historical data from the database and apply a detection algorithm to find anomalous activity in the data set; and (i) a visualization analysis engine configured to: display the selected data from the database in real-time; enable a system administrator to identify suspicious activity, not automatically identified by the intrusion detection model, as an attack in real-time; and update the intrusion detection model based on the suspicious activity identified by the system administrator.