Patent ID: 8769687

Claim:
A method comprising: directing incoming electronic mail from an internet backbone network to a scanning system that interfaces between the internet backbone network and one or more intranets associated with different organizations; scanning incoming electronic mail associated with the one or more intranets to detect malicious code; generating a plurality of events indicating an outcome of the scanning; correlating the events across the intranets to detect multi-pronged or multi-phased attacks from different network locations using different methods; responding to the detected attacks by initiating a change dictated by policy; redirecting suspicious traffic from the internet backbone network to a decoy server that is configured to act as a legitimate server; receiving at the decoy server actions of an intruder; and logging the actions of the intruder, wherein the policy is set by a customer and a determination of whether to scan all incoming electronic mail, to scan only executable attachments to the incoming electronic mail, or to scan only incoming electronic mail containing documents with embedded macros, is selectable by the customer, and sender and recipient of the electronic mail are notified of the detection of a malicious code, as determined by the policy, wherein the notification is performed by at least one of appending text to body of the electronic mail and/or sending a new electronic mail to the sender and recipient.