Data from multiple sources is processed in an attempt to positively identify attacks targeted at, or affecting significant portions of, the Internet infrastructure. This involves interpreting, extracting data from, analyzing, and recording information on the basis of the incident report. Part of the analysis that occurs with a new incident report is correlation with data that has been received from all input sources and past incidents. Collections of data representing related attacks are referred to as an incident. One incident can represent something minor, such as a single probe to a single site, or something significant, such as the Melissa virus.
Additional analysis involves identifying instances of known methods or signatures of attack.
Any attack method identified that cannot be represented by a common, well-known signature is investigated by the incident analyst until the details of the attack can be determined. When novel methods of attack are uncovered, the analyst records a signature for that attack and determines what the likelihood of attack is and what the threat is for the use of the attack on the Internet infrastructure. If the threat exceeds a certain threshold, a CERT Advisory is issued. On the basis of the information received from the Internet community, critical information about specific threats is disseminated through security alerts, such as CERT Advisories, Incident Notes, Vulnerability Notes, and Vendor-Initiated Bulletins. CERT Advisories address Internet security problems.