Patent ID: 11956208
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to execute a method comprising:
detecting network incidents associated with a user device, the network incidents relating to security threats in a network;
grouping the network incidents into one or more groups based on types of the security threats associated with the network incidents;
generating a graph for a group of the one or more groups, the graph including a plurality of nodes, each node representing a behavior indicator associated with the group, wherein generating the graph includes:
assigning an edge to connect a first node and a second node when the first node and the second node correspond to behavior indicators that belong to a same network incident, and
assigning a weight to the edge based on a number of co-occurrences of the first node and the second node in the group; and

displaying the graph on a graphical user interface.