Patent ID: 8621618

Claim:
A method for assessing whether a communication contains an attack, the method comprising: maintaining, by an attack detection device, a database comprising attack profiles aggregated from remote network sites, the attack profiles characterizing attacks according to a plurality of hierarchical parameters and according to results of a plurality of countermeasure assessments; receiving the communication; associating the plurality of hierarchical parameters with the communication; applying the plurality of countermeasure assessments to the communication, each countermeasure assessment producing a respective probability that the communication contains an attack and a respective confidence score for the respective probability; producing a composite probability that the communication contains an attack and a composite confidence score for the composite probability in response to processing each of the respective probabilities and each of the respective confidence scores that weights each of the respective probabilities by referencing the plurality of hierarchical parameters of the communication to one or more of the attack profiles in the database; determining that the communication contains a new attack based on the composite probability and the composite confidence score; and updating the database to include a new attack profile associated with the new attack; wherein: updating the database according to new attacks comprises automatically updating the database in response to determining that the composite probability exceeds a first threshold and that the composite confidence exceeds a second threshold; and the remote network sites comprise clients of a business that provides attack detection equipment or services.