Patent ID: 8453234

Claim:
One or more computer-readable storage devices having thereon computer-readable code for performing a method for operating a centralized security management system, comprising: collecting a plurality of data from a set of devices in a network; determining each of a first baseline operation for each of the set of devices wherein determining the first baseline operation includes correlating the plurality of data from disparate events in each device and identifying a normal operating condition for each device; determining a second baseline operation for the network wherein determining the second baseline operation includes identifying the normal operating condition for the network and at least one of correlating the plurality of data from different times and correlating the plurality of data from disparate events across different devices; modifying the first baseline operation or the second baseline operation based on a change in the collected plurality of data; and identifying an anomaly condition to the first baseline operation, the second baseline operation, the modified first baseline operation, or the modified second baseline operation, further comprising determining if the anomaly condition is an attack on a member of the set of devices or the network; wherein determining each of the first baseline operation comprises operating a behavioral engine that learns or trains to identify the normal operating condition for each of the set of devices; wherein determining the second baseline operation comprises operating the behavioral engine that learns or trains to identify the normal operating condition for the network.