Cyber-attacks against companies and governments are seeing an increase in complexity and persistence. These more complex attacks are aimed at penetrating corporate and government networks to obtain classified information. Common intrusion detection methods lack in their ability to detect such complex attacks. A framework is proposed to relate attack characteristics to analysis methods and business criteria. Traditional signature based detection algorithms still remain useful but the advanced approach of the attackers requires the use of intelligent data analysis. The framework is used as a roadmap to design a system capable of detection advanced persistent threats.