Patent ID: 7873717

Claim:
A method for forensic analysis of events in an event listing comprising: a security device arranging a plurality of correlation objects in a hierarchical decision tree having multiple layers, each correlation object including a correlation rule that defines a correlation that is to be performed by the correlation object, at least one of the layers having parent correlation objects to which children correlation objects are assigned; the security device applying the decision tree to the event listing to perform a forensic analysis in an order of correlation objects that is defined by a correlation thread, the correlation thread initiating a correlation by one of the parent correlation objects which results in one of a success or failure, wherein said applying the decision tree to the event listing to perform the forensic analysis comprises the security device evaluating the event listing against the correlation rules of the correlation objects in the order defined by the correlation thread; in the event of a success of the parent correlation object, the security device storing results of evaluating the correlation rule of the parent correlation object against the event listing in a parent event listing corresponding to the parent correlation object, the parent event listing comprising a subset of events of the event listing, and initiating, by the correlation thread, evaluating the parent event listing against the correlation rule of one of the child correlation objects assigned to the successful parent correlation object; and in the event of a failure of the evaluating performed by the parent correlation object, the correlation thread initiates evaluating of the event listing against a correlation rule of another parent correlation object, wherein the parent correlation object defines a time frame of the event listing from which events can be drawn for the correlation, wherein a second time frame corresponding to the child correlation object is calculated relative to the time frame defined by the parent correlation object.