Patent ID: 9560068
Date: 2017-01-31
CPC Classifications: H04L

Claim:
1. A method for detecting an intrusion attempt in a network comprising a plurality of host machines, the method comprising: receiving, at a first host machine, one or more security reports relating to one or more host machines of the plurality of host machines in the network, the one or more security reports summarizing security data based on network traffic at a respective host machine indicative of a possible intrusion attempt and/or context data local to the respective host machine; correlating, at the first host machine, the one or more security reports with security data based on network traffic at the first host machine; associating, at the first host machine, a level of security concern based at least on the correlation exceeding a threshold; and based at least on the level of security concern indicating a network intrusion attempt, notifying at least one other host machine of the plurality of host machines of the level of security concern.