Patent ID: 7603711

Claim:
A computer network intrusion detection system comprising: a plurality of different log analyzers for different external networks, each log analyzer being configured for detecting attacks upon a firewall in an corresponding one of the different external networks defining an edge detection network; an edge database log coupled to the different log analyzers logging attacks upon the different external networks; an intrusion detector coupled to a client network and configured to detect external attacks upon the client network; an analyzer coupled to said intrusion detector for analyzing each detected attack and determining a characteristic indicative thereof to classify each detected attack as a general attack or a client specific attack based upon logged attacks in the edge database log; and, a filter coupled to said analyzer for generating an alert based upon characteristics of a plurality of attacks; a second intrusion detector for detecting external attacks upon a second computer network; and, a second analyzer coupled to said second intrusion detector for analyzing each detected attack upon the second network and determining a characteristic indicative thereof, wherein said filter is further coupled to said second analyzer and further compares the attack characteristics determined by said analyzer and said second analyzer and generates a specific attack alert in response to a substantial absence of similarity in the comparison.