Network security architecture

An apparatus comprising:

• at least one processor;
• and
• at least one memory including computer program code, the memory and the computer program code configured to, with the processor, cause the apparatus to perform at least the following:
• direct incoming electronic mail from an internet backbone network to a scanning system that interfaces between the internet backbone network and one or more intranets associated with different organizations,
• scan incoming electronic mail to detect malicious code,
• generate a plurality of events indicating an outcome of the scanning,
• correlate the events across the intranets to detect multi-pronged or multi-phased attacks from different network locations using different methods;
• respond to the detected attacks by initiating a change dictated by policy;
• redirect suspicious traffic from the internet backbone network to a decoy server that is configured to act as a legitimate server;
• receive at the decoy server actions of an intruder;
• and
• log the actions of the intruder,
• wherein the policy is set by a customer and a determination of whether to scan all incoming electronic mail, to scan only executable attachments to the incoming electronic mail, or to scan only incoming electronic mail containing documents with embedded macros, is selectable by the customer, and sender and recipient of the electronic mail are notified of the detection of a malicious code, as determined by the policy, wherein the notification is performed by at least one of appending text to body of the electronic mail and/or sending a new electronic mail to the sender and recipient.

A system comprising:

• a scanning system including at least one processor and at least one memory, the scanning system configured to receive incoming electronic mail from an internet backbone network, wherein the scanning system is further configured to interface between the internet backbone network and one or more intranets associated with different organizations,
• wherein the scanning system is further configured to scan incoming electronic mail to detect malicious code, to generate a plurality of events indicating an outcome of the scanning, to correlate the events across the intranets to detect multi-pronged or multi-phased attacks from different network locations using different methods, and to respond to the detected attacks by initiating a change dictated by policy;
• and the scanning system is further configured to:
• redirect suspicious traffic from the internet backbone network to a decoy server that is configured to act as a legitimate server,
• receive at the decoy server actions of an intruder, and
• log the actions of the intruder,
• wherein the policy is set by a customer and a determination of whether to scan all incoming electronic mail, to scan only executable attachments to the incoming electronic mail, or to scan only incoming electronic mail containing documents with embedded macros, is selectable by the customer, and sender and recipient of the electronic mail are notified of the detection of a malicious code, as determined by the policy, wherein the notification is performed by at least one of appending text to body of the electronic mail and/or sending a new electronic mail to the sender and recipient.