Patent ID: 7007301

Claim:
A computer architecture for an intrusion detection system, comprising: a control agent to interface with a management system and to monitor system activity; at least one data gathering component which gathers kernel audit data and syslog data; at least one correlator to interpret and analyzes the kernel audit data and the syslog data using at least one detection template, wherein said at least one correlator uses an event driven correlation using an Event Correlation Services (ECS) engine core, wherein said at least one detection template is selected from the group including: a modification of files/directories template; a chance to log files template; a SetUID files template; a creation of world-writables template; a repeated failed logins template; a repeated failed SU commands template; a race conditions attack template; a buffer overflow attacks template; a modification of another user's file template; a monitor for the start of interactive sessions template; and a monitor logins/logouts template.