Patent ID: 8719943

Claim:
A device comprising: a) at least one intrusion detection device configure to log detected intrusions on a network; and b) at least one hardware processor configured to: i) generate a multitude of event reports, each of the multitude of event reports used to report detected intrusions; ii) associate each of the multitude of event reports with at least one of a multitude of exploits, the multitude of exploits mapped on an attack graph for the network, the attack graph constructed by mapping interdependencies among the multitude of exploits with respect to a multitude of conditions on a multitude of processing machines in the network, at least one of the multitude of exploits including at least one precondition mapped to at least one postcondition, the multitude of conditions including at least one of the at least one precondition and at least one of the at least one postcondition; iii) determine exploit distances for at least one exploit pair, each of the at least one exploit pair being a pair of the multitude of exploits on the attack graph; iv) create an event graph by mapping at least one of the multitude of event reports to at least one other of the multitude of event reports; v) determine event graph distances for at least one event pair, each of the at least one event pair being a pair of the multitude of event reports on the event graph; vi) calculate a multitude of correlation values, each of the multitude of correlation values calculated for at least one of the at least one event pair using the event graph distances; and vii) look for coordinated attacks by analyzing the multitude of correlation values using a correlation threshold.