Patent ID: 8516576
Filing Date: 2013-08-20
Classification: H04L

Abstract:
1. A method for detecting an intrusion attempt in a network comprising a plurality of host machines, the method comprising: monitoring, at a first host machine, local network activity at the first host machine; receiving, at the first host machine, at least one security report from one or more host machines in the network, each security report summarizes network traffic at a respective host machine indicative of a possible intrusion attempt at a respective host machine and/or context data local to a host machine; correlating, at the first host machine, the at least one security report with the local network activity; associating, at the first host machine, a level of security concern when a correlation exceeds a threshold; when the level of security concern indicates a network intrusion attempt, generating a second security report indicating a suspected network intrusion attempt; and correlating a plurality of security reports including the second security report to determine whether a network intrusion attempt is detected, the plurality of security reports being generated by multiple host machines.