Correlation engine for detecting network attacks and detection method

Abstract

A method for detecting network attacks is provided. In one implementation, the method receives a plurality of attack indications based on data transmitted on the network and applies rules to the plurality of attack indications. Also, the method generates an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack. In addition, a network device that performs the method and a computer program corresponding to the method are provided.

1 . A method for detecting network attacks, comprising:
 (a) receiving a plurality of attack indications based on data transmitted on the network;   (b) applying rules to the plurality of attack indications; and   (c) generating an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack.