Patent ID: 9009828
Filing Date: 2015-04-14
Classification: G06F,H04L

Abstract:
1. A method comprising: receiving at a network protection system a first alert from a first intrusion detection system associated with a first protected network, wherein the first alert is triggered by first network traffic that is evaluated by the first intrusion detection system and that is determined to match a first signature that is associated with undesired network behavior; receiving at the network protection system a second alert from a second intrusion detection system associated with a second protected network, wherein the second alert is triggered by second network traffic that is evaluated by the second intrusion detection system and that is determined to match the first signature; determining a source of the network traffic that triggered the first alert and the second alert; grouping at the network protection system the first alert and the second alert into an alert group based upon a common characteristic between the first alert and the second alert; assigning a determination to the alert group, the determination indicating a threat level associated with the alert group; establishing a predetermined alert threshold indicative of whether the a source of the alert group should be blocked; and determining that a number of alerts associated with the source exceeds the alert threshold; creating at the network protection system a second signature in response to determining to that the number of alerts exceeds the alert threshold; and providing the second signature to the first intrusion detection system and to the second intrusion detection system, such that the first intrusion detection system and the second intrusion detection system are configured to block network traffic that originates from the source.