The search for anomalies and attacks is possible by using the global view. The most popular method to allocate malware for example is via email. Figure 1 demonstrates the distribution of emails with an attachment (purple) and emails with the explicit ZIP attachment (red).

The analysis of the global view shows that the ZIP attachment has not occurred for some months. So this is not the normal situation. The partners are able to protect themselves in-time and may update the definition of their virus protection system or something like that.