Steady state computer intrusion and misuse detection

摘要

A system and method provide for detecting intrusion and misuse of a computer in a computer network. The system includes an agent manager that directs actions of software agents to collect computer performance parameters from the computer, and a data analyzer that summarizes the collected computer performance parameters and generates a user profile. The system further includes a comparator that compares the summarized computer performance data and the user profile and generates a prompt based on a set of criteria related to the computer performance data and the user profile.