Patent ID: 7748040

Claim:
A method comprising: receiving, by an attack correlation system of a protected network, a probe communication from a probing computing device; in response to the probe communication, accessing a database maintained by the attack correlation system to determine whether the probing computing device has previously probed the protected network; when the probing computing device has not previously probed the protected network, dynamically generating marked information, storing the marked information to be associated with an identification of the probing computing device within an entry of the database, and sending the marked information to the probing computing device, wherein the marked information comprises detectable false information that is traceable by the attack correlation system and is uniquely generated for the probing computing device; after sending the uniquely generated marked information to the probing computing device, receiving from an attack device a communication addressed to a device within the protected network; analyzing the communication to determine that the communication contains the uniquely generated marked information that is also stored within the entry of the database of the attack correlation system, thereby allowing the attack correlation system to determine that the communication is a potential attack; responsive to determining that the communication contains the uniquely generated marked information, accessing the database of the attack correlation system to correlate, based on the uniquely generated marked information, the potential attack received from the attack device with the probe communication previously received from the probing computing device based upon the association between the uniquely generated marked information and the probing computing device within the entry of database; updating the entry of the database to associate the probe communication received from the probing computing device with the communication received from the attack device as coordinated phases of the same network attack against the protected network, wherein the updating of the entry of the database includes storing an identification of the attack device to be associated with both the uniquely generated marked information and with the identification of the probing computing device; and rerouting the communication to a vulnerable device when the uniquely generated marked information is detected within the communication.