Patent ID: 7024694

Claim:
A method for providing content-based intrusion detection for a computer system by using an agile kernel-based auditing system, comprising: receiving an audit specification; wherein the audit specification specifies at least one target attribute to be recorded from a set of possible target attributes during an auditing process by the auditing system; wherein the audit specification also specifies at least one auditing criterion that triggers recording of the at least one target attribute during the auditing process; configuring the auditing system to record the at least one target attribute in response to detecting the at least one auditing criterion; running the auditing system to produce an audit log by recording the at least one target attribute in response to detecting the at least one auditing criterion; and examining the audit log to detect patterns for intrusion detection purposes; wherein a size of the audit log is reduced when the auditing system is run prior to the examination for detection of the patterns.