Mary R Mathews, 49182 Mill Green Ave UNIT 200, Gaithersburg, MD 20878

2014033, Nov 13, 2014

Apr 15, 2014

14/253569

Anupam JOSHI - Ellicott City MD, US
Timothy Wilkin FININ - Ellicott City MD, US
Mary Lisa Mathews - Elkridge MD, US

H04L 29/06

726 23

A semantic approach to intrusion detection is provided that can utilize traditional as well as nontraditional data sources collaboratively. The information extracted from these traditional and nontraditional data sources is expressed in an ontology, and reasoning logic rules that correlate at least two separate and/or distinct data sources are used to analyze the extracted information in order to identify the situation or context in which an attack can occur. By utilizing reasoning logic rules that contain rules that correlate at least two separate and/or distinct data sources, a threat or attack can be determined using data that is spatially (e.g., geographically) and temporally separated, resulting in a context aware IDPS that can relate disparate activities spread across time and multiple systems as part of the same attack.