A host-based intrusion defense tool, Dragon Host Sensor monitors individual systems running today's most common operating systems, for evidence of malicious or suspicious activity in real time. Dragon Host Sensor may be deployed on a protected host where it uses a variety of techniques to detect attacks and misuse on the system, including analyzing the security event log, checking the integrity of critical configuration files, or checking for kernel level compromises. This hybrid approach ensures that no misuse goes undetected. Dragon Host Sensor may also be deployed on a dedicated analysis system where logs are forwared and analyzed from most commercial firewalls, routers, switches, and other IDS devices. Correlating events from these devices and from Dragon Network and Host Sensors is critical in identifying which events are the most serious, as well as understanding their origin and impact. Using non-conventional techniques to identify attempted intrusions or general misuse, the Host Sensor can be installed on a dedicated system to create a "deceptive" server designed to entice an alarm on attempted intrusions by simulating a fake web server, telnet server, or mail server.