Abstract: The present invention comprises a method of defining security conditions of a computer system. The method comprises the steps of specifying an identity of attack, specifying at least one attribute of the specified attack, and specifying at least one policy definition with respect to the specified attack, specifying at least one attribute of the specified policy definition.

Abstract: The present invention comprises a method of defining security conditions of a computer system for the purpose of detecting vulnerabilities. The method comprises the steps of specifying a attack representing a recognized vulnerability of the computer system, specifying at least one attribute of the specified attack, specifying at least one policy definition with respect to detecting the vulnerability of the specified attack, specifying at least one attribute of the specified policy definition, and specifying a remedy for the specified vulnerability.

Abstract: A network intrusion detection system comprises a processor and a memory accessible by the processor. The system also comprises a monitor application stored in the memory and executable by the processor. The monitor application is adapted to monitor network activity associated with a network node. The system also comprises a profile application stored in the memory and executable by the processor. The profile application is adapted to automatically generate an activity profile associated with the network node using the monitored network activity. The system further comprises a recognition engine stored in the memory and executable by the processor. The recognition engine is adapted to compare a network event to the activity profile to determine whether the network event is authorized for the network node.

Abstract: A computer comprising an operating system that controls the computer resources. An intrusion detection system is integrated with the operating system and operable to monitor the computer resources to detect, prevent and report intrusion attempts. An anti-virus system is further integrated with the operating system and operable to detect the presence of at least one virus in the computer resources.