The great number of heterogeneous interconnected operating systems gives greater access to intruders and makes it easier for malicious users to break systems security policy. Also, a single security control agent is insufficient to monitor multiple interconnected hosts and to protect distributed operating systems from hostile uses. This paper shows the ability of distributed security controller's agents to correlate data stream from heterogeneous hosts and to trace abnormal behavior in order to protect network security. An experimental study is done to improve our proposed approach.