Patent ID: 7398310

Claim:
A method comprising: receiving node information for a node coupled to a computer network; analyzing the received node information to identify a unique identifier; selecting at least a security identified provided by an operating system of the node for the unique identifier when the analysis indicates that the node information includes the security identifier; selecting at least a serial number provided by a basic input output system of the node for the unique identifier when the analysis indicates that the node information does not include the security identifier; selecting at least a physical address for the unique identifier when the analysis indicates that the node information does not include either of the security identifier and the serial number; determining whether to issue an alarm indicating a network intrusion responsive to receiving the node information by comparing the unique identifier to a database; automatically linking at least a portion of said node information to an existing database entry in the database and not issuing the alarm when the comparison indicates a tracked entity that corresponds to the node; and issuing the alarm indicating the network intrusion and creating a new database entry when the comparison indicates that the node is a new entity.