Patent ID: 8776228

Claim:
An intrusion detection system comprising a processor, and a memory with instructions which when executed by the processor cause the processor to perform a plurality of operations, the plurality of operations comprising: receiving transaction information related to a current transaction between a client entity and a resource server; accessing a database storing a plurality of transaction groups, wherein the transaction groups are formed based on a plurality of past transactions between a plurality of client entities and the resource server; analyzing the received transaction information with respect to information related to at least one of the plurality of transaction groups associated with a user, the user associated with the current transaction; based on said analyzing, determining a possibility of an occurrence of an intrusion act at the resource server; and dynamically updating the plurality of transaction groups based at least on the received transaction information, wherein said dynamically updating comprises disassociating the user from the at least one of the plurality of transaction groups, associating the user with a transaction group other than the at least one of the plurality of transaction groups, or both; obtaining identity information of the user; and based on a determination that the intrusion act has occurred at the resource server, one or more selected from: modifying access privileges of the user for accessing one or more of the plurality of client entities, the resource server, or a combination thereof, notifying an administrative entity about the intrusion act, or recording the received transaction information, the identity information, or both, in a list of intrusion acts.