Patent ID: 8112521

Claim:
A method, comprising: issuing a communication associated with one or more programs to one or more devices in a network; detecting a response to the communication from each of the one or more devices; detecting an event logger message from an event logger when the one or more devices sends an event logger event message to the event logger in response to the communication; analyzing, by a hardware processor, the response and the event logger message; identifying a threat response when at least one of the detected response represents one of an unexpected response or a response time-out indicating a lack of response from the one or more devices, or the event logger message reports an event; determining a network vulnerability based on identification of the threat response; sending a follow-up communication to the one or more devices returning the threat response; detecting a follow-up response from each of the one or more devices returning the threat response; and analyzing the follow-up response to determine a network threat condition resulting in the threat response.