Embodiments of the present invention provide systems and methods for thwarting attempts at the unauthorized access to the restricted resources within the target server in a multi-node system. Real-time detection of the user ID and thread ID associated with attempts to access the restricted resources within the target server in a multi-node system is achieved by analyzing causality, message queue, and event-driven patterns.