Patent ID: 8572733

Claim:
A network security system, comprising: a plurality of sensors operable to receive first data associated with potential attacks on a network security system; a manager server coupled to at least one of the plurality of sensors and comprising a first processor, the manager server operable to: correlate at least a portion of the first data based on a correlation rule set to detect potential attacks on the system; and communicate a query comprising the first data and the correlated data, the correlated data being based at least in part on the correlation of at least a portion of the first data; and a data collection module coupled to the manager server and an archive database, the data collection module comprising a second processor, the data collection module operable to: receive the query from the manager server; generate at least one request for second data based upon the received query; communicate the at least one request to at least one source different from the plurality of sensors, wherein the at least one source is a server that translates IP addresses; correlate second data received from the server that translates IP addresses with at least a portion of the first data received by the plurality of sensors; and generate a relationship score indicating a likelihood that the first data is related to a previous potential attack based on the correlated second data and event history in the archive database; the first data associated with potential attacks on the network security system being communicated from the plurality of sensors to the manager server without passing through the data collection module.