Patent ID: 7934253

Claim:
A plurality of networks comprising: a security module in one or more of the plurality of networks comprising, a network traffic port adapted to receiving network traffic; a processor adapted to verify the traffic against a profile of acceptable behavior for a user of the network, identify anomalous user traffic, and to analyze the anomalous traffic by at least one threat-detection engine, wherein results from the at least one threat-detection engine are correlated to determine if there is a threat to the network; an output configured to communicate security events to a central security manager; an input configured to receive instructions from the central security manager, wherein the security module responds in accordance with the instructions; a centralized security manager comprising, an input adapted to receive security events from the security module within one of the plurality of networks; a processor adapted to analyze the security events from the plurality of networks to identify security threats across the networks and to determine an appropriate response to the threat by the plurality of networks based upon a security policy, wherein the analysis of the security events includes correlating information from the plurality of networks against a profile of acceptable behavior for a user of the network, wherein correlating information from the plurality of networks further comprises aggregating event information from the plurality of networks to determine whether a security threat exists, and wherein the plurality of events when viewed separately are not severe enough to indicate an attack and an output adapted to communicate instructions for responding to the security threat to the security module in network.