Abstract: A computer/computer network security alert management system aggregates information from multiple intrusion detectors. Utilizing reports from multiple intrusion detectors reduces the high false alarm rate experienced by individual detectors while also improving detection of coordinated attacks involving a series of seemingly harmless operations. An internal representation of a protected enclave is utilized, and intrusion detection system (IDS) information is correlated to accurately prioritize alerts. In one embodiment, the system is capable of utilizing data from most existing IDS products, with flexibility to add further IDS products.

Abstract: A system and method for providing ontology objects for use in a metamodeling environment is disclosed herein. The method comprises (a) providing a framework for creating a metamodel, wherein the metamodel comprises one or more entities, relationships, and semantics and the framework accepts input from a user to create the entities, relationships, and semantics, (b) generating ontology objects, wherein the ontology objects comprise source code for one or more classes, and wherein each class corresponds to one of the entities; and (c) compiling the source code. Further, the method may comprise detecting that a change has been made to the metamodel, updating the ontology objects to reflect the change to the metamodel, wherein updating the ontology objects comprises generating new source code for one or more classes; and compiling the new source code.