Patent ID: 8776226

Claim:
A method for robustly determining the occurrence of an SSH login attack on a computer, comprising the steps of: on a digital event correlation engine; detecting the occurrence of an SSH login attack event; determining the number of occurrences of the SSH login attack event over a predetermined periods of time exceeding predetermined time limits; thresholding the number of determined SSH login attack event occurrences to provide a threshold number of determined event occurrences, the thresholding step having an output, and further including the step of taking the output of the thresholding step and inputting it into a follow on digital filter having determination and threshold functions in a serial manner, the determination function determining SSH login attack event occurrences over a longer periods of time than that associated with a prior determining, whereby occurrences of an SSH login attack over ever increasing long periods of time can be robustly indicated; and, indicating an attack when the number of determined SSH login attack event occurrences exceed the threshold number established by the thresholding, whereby the occurrence detecting and thresholding constitute digital event filtering.