1. A method implemented in a network(s) including a plurality of intelligent security agents distributed across the network(s) comprising: identifying an on-going attack through behavioral analysis protection in said network(s); creating a generic attack signature rule of DoS and Worms attack through said behavioral analysis; propagating said created generic attack signature to a controller; wherein said controller receives said created generic attack signature from an intelligent security agent and, based on generic signature attributes parameters and propagation rules, said controller selects and updates a black list associated with each of said plurality of intelligent security agents distributed across said network(s) with said created generic attack signature.