US 6405318

US 6,405,318 B1 — Intrusion Detection System: Overview

Title: Intrusion Detection System
Patent number: US 6,405,318 B1
Inventor: Craig H. Rowland
Original assignee: Psionic Software Inc. (current assignee listed as Cisco Technology Inc./Cisco Systems Inc.; the source notes assignee listings may be inaccurate)
Application number: US09/268,084
Priority/filing date: 1999-03-12
Publication (grant) date: 2002-06-11
Legal status: Expired – Lifetime; anticipated expiration 2019-03-12

Purpose. The patent relates generally to intrusion detection for a computer system — a computer-implemented system and method that monitors a computer system for activity indicative of attempted or actual access by unauthorized persons or computers. The stated aim is a real-time system that automatically builds user profile data (a "signature") for each user, or class of users, to reduce false alarms, detect suspicious actions, determine their source, and institute autonomous responses without waiting for human intervention.

Plain-language scope. As described in the excerpt, the system comprises a log audit function, a login anomaly detection function, a logout anomaly detection function, a session monitor function, and a port scan detector function, all interfacing with a local controller function and all operating in real-time. Each detection function notifies the controller and sends information about detected activity for further processing. User profile data is saved and updated on each logon and logoff; automatic actions (e.g., logging events, disabling user accounts, blocking access) can be pre-specified by the system administrator. The system also coordinates information transfer within host, multi-host and network environments. The source lists figures covering the host-based configuration (FIG. 1), log file auditing (FIG. 2), login/logout anomaly detection (FIGS. 3, 5A–5B), profile database updates (FIG. 4), port scanning (FIG. 6), session monitoring (FIG. 7), the controller (FIG. 8), and an alternate embodiment with a central system controller (FIG. 9).

Not established by this excerpt. The supplied text does not include the claims, the detailed description's full content, references cited, or prosecution history; specific claim limitations, prior-art relationships, and the accuracy of the assignee listing therefore cannot be confirmed from it.

Source: https://patents.google.com/patent/US6405318/en