For years, the Intrusion Detection System (IDS) industry has worked on bringing a solution to anomalybased attacks on computer networks. The main concerns related to the IDS implementations have been: the low detection rate of anomaly-based attacks that provokes low usability and high rate of false positives that cause low acceptability. Researchers in the eld of IT have proposed dierent approaches using numerous techniques to improve these rates. This paper brings an approach based on the problematic faced by networks when anomaly-based attacks emerge. Our approach proposes a novel framework based on analyzing real-time information and classifying trac in a binary way, legitimate or an intrusion. Log information will be correlated with the same customized format, ltered and stored in mongoDB by a Collaborative Intrusion Detection System (CIDS). Work presented in this paper on CIDS will be the main entity for examining correlation in the log information. While correlating the information with the help of mongoDB, the framework will be able to rapidly determine the existence of anomaly-based intrusions and will notify the dierent network entities in the network of the intrusion. The framework will dynamically adapt to the kind of trac present in the network. The case study in this paper is based on the typical Brute Force Attack launched to any server running the SSH protocol. The SSH protocol was selected because it is the default remote protocol sysadmins use for remote connections on networks worldwide