Symantec Corporation

Sri International

Douglas B Moran

Adam John Cheyer

William Scott Mark

David L Martin

A system and method are disclosed for detecting intrusions in a host system on a network. The intrusion detection system comprises an analysis engine configured to use continuations and apply forward- and backward-chaining using rules. Also provided are sensors, which communicate with the analysis engine using a meta-protocol in which the data packet comprises a 4-tuple. A configuration discovery mechanism locates host system files and communicates the locations to the analysis engine. A file processing mechanism matches contents of a deleted file to a directory or filename, and a directory processing mechanism extracts deallocated directory entries from a directory, creating a partial ordering of the entries. A signature checking mechanism computes the signature of a file and compares it to previously computed signatures. A buffer overflow attack detector compares access times of commands and their associated files. The intrusion detection system further includes a mechanism for checking timestamps to identify and analyze forward and backward time steps in a log file.

System and method for using timestamps to detect attacks

System and method for using login correlations to detect intrusions

Extensible intrusion detection system

System and method for using signatures to detect computer intrusions

System and method for detecting computer intrusions

A distributed agent community is able to dynamically interact with alternative sofware technologies that manage distributed objects. The leveraging of capabilities of distributed object systems greatly expands the flexibility and capabilites of the distributed agent community. Through access to distributed object systems, the distributed agent community can draw on the capabilites of all the objects managed by the distributed object systems. The access to distributed systems by the distributed agent community allows for collaboration and intelligent planning that the distributed object systems do not themsleves provide.

Extensible software-based architecture for communication and cooperation within and between communities of distributed agents and distributed objects

System and method for detecting buffer overflow attacks

System and method for analyzing filesystems to detect intrusions

Growing community of inventors

Palo Alto, CA, United States of America

Douglas B Moran