A method for managing Denial of Service (DoS) situations at an application level of the Open System Interconnection Model in a communications network receiving message data, and comprising an intranet connection network connected to an outside network and at least one event sensor (10; 72), the method comprising: monitoring, by said event sensor, said message data on the intranet connection network to detect an event; generating, by the event sensor, at least one event message and sending it to a control logic (11; 76) through the intranet connection network; determining, by the control logic (11; 76), a first analysis to be performed associated with said event message, generating, by the control logic (11; 76), a request of said first analysis and sending it to at least one of a plurality of analysis modules (12; 73, 74) through the intranet connection network, wherein determining a first analysis comprises performing a first browsing of rules, each rule including a conditional clause and an associated action to be taken, and determining a first rule including said event message as a conditional clause and said first analysis as the action to be taken; receiving, by the analysis module, said request of first analysis, performing said first analysis and sending a first result message to the control logic through the intranet connection network; receiving, by the control logic, said first result message and determining an action to be taken associated with said first result message including performing a second browsing of rules and determining a second rule including said first result message as a conditional clause; based on the action to be taken, by the control logic, either sending a request of further analysis to be performed to at least one of the analysis modules or generating a countermeasure message requestinga countermeasure to be taken. monitoring, by said event sensor, said message data on the intranet connection network to detect an event; generating, by the event sensor, at least one event message and sending it to a control logic (11; 76) through the intranet connection network; determining, by the control logic (11; 76), a first analysis to be performed associated with said event message, generating, by the control logic (11; 76), a request of said first analysis and sending it to at least one of a plurality of analysis modules (12; 73, 74) through the intranet connection network, wherein determining a first analysis comprises performing a first browsing of rules, each rule including a conditional clause and an associated action to be taken, and determining a first rule including said event message as a conditional clause and said first analysis as the action to be taken; receiving, by the analysis module, said request of first analysis, performing said first analysis and sending a first result message to the control logic through the intranet connection network; receiving, by the control logic, said first result message and determining an action to be taken associated with said first result message including performing a second browsing of rules and determining a second rule including said first result message as a conditional clause; based on the action to be taken, by the control logic, either sending a request of further analysis to be performed to at least one of the analysis modules or generating a countermeasure message requestinga countermeasure to be taken.