1. A method implemented in a network including a plurality of intelligent security agents distributed across the network, comprising: identifying an on-going attack through behavioral analysis protection in said network; creating a generic attack signature of at least one of a denial-of-service (DoS) attack and a worm attack through said behavioral analysis by at least one of said plurality of intelligent security agents; sending said created generic attack signature to a controller; wherein said controller: receives said created generic attack signature from one of the plurality of intelligent security agents, matches said created generic attack signature to a plurality of propagation rules, selects one or more of said plurality of intelligent security agents to propagate said created generic attack signature to, when the said created generic attack signature matches at least one of the plurality of propagation rules, and propagates said created generic attack signature to the selected one or more of said plurality of intelligent security agents, wherein a blacklist associated with each of the selected one or more of said plurality of intelligent security agents is dynamically updated with the at least one propagated created generic attack signature, wherein each of said plurality of propagation rules defines at least one or more of the plurality of intelligent security agents that the created generic attack signature is propagated to, based in part on the intelligent security agent that created said generic attack signature, and attributes of said generic attack signature, wherein said attributes include at least one of the following attributes: an accuracy level of signature, a worm characteristic level, an attack rate, an attack direction, and a generality type.