Patent ID: 8286249
Filing Date: 2012-10-09
Classification: H04L

Abstract:
1. A method comprising: generating a marked information database maintained by a first attack correlation system comprising at least one processor, wherein the database stores data that associates (1) identifiers of potential attack devices that sent probe communications to a protected network, (2) marked information uniquely generated and traceable by the first attack correlation system for each individual potential attack device in response to each of the probe communications, and (3) identifiers of attack devices that subsequently send communications that each include marked information uniquely generated for a corresponding one of the potential attack devices; receiving, by the first attack correlation system, a communication sent from a first attack device; responsive to determining that the communication includes marked information uniquely generated for a first potential attack device, updating the marked information database to indicate that the communication and a corresponding probe communication previously sent from the first potential attack device are coordinated phases of one network attack against the protected network, wherein updating the marked information database includes associating an identifier of the first attack device with an identifier of the first potential attack device based on the marked information uniquely generated for the first potential attack device; and exchanging at least a portion of the data stored in the marked information database with a second attack correlation system different from the first attack correlation system.