1. A computer-implemented method for protecting a network, the method comprising: gathering information about the network; using the gathered information to determine vulnerabilities of one or more hosts on the network; examining network traffic to determine intrusions on the network; and correlating the determined vulnerabilities of the hosts with the detected intrusions to identify network traffic indicative of an exploitation of one or more of the determined vulnerabilities.