User, process, and application tracking in an intrusion detection system

摘要

Preferred embodiments combine audit records with other relevant information to identify and track the users, processes or applications responsible for an attack. Information that identifies a user, process, or application may be associated with subsequent audit records related to the user or process session; this information may also be associated with IDS alerts related to the session. By reliably identifying the source of user and process sessions, the preferred embodiments make it possible to selectively target the sessions and applications that are related to an intrusion or attack.