Patent ID: 9444829
Filing Date: 2016-09-13
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method for protecting computing resources based on logical data models, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving, from a security agent, log data that specifies details of a security event detected by the security agent; creating an instance of a data structure for a logical data model that describes a path cycle of a security threat, the data structure including fields that specify at least an origin and a target of the security threat; populating at least one field of the data structure for the logical data model based on the details specified by the received log data; populating at least one other field of the data structure for the logical data model with a value of incomplete based on a completed value for the other field being unavailable; performing an analysis of a group of instances of the data structure for the logical data model, the group including the instance of the data structure for the logical data model, by determining a proportion of the group of instances that have a value of incomplete at the other field; performing a security action to protect users by targeting investigation resources based on the analysis of the group of instances of the data structure for the logical data model that determined the proportion of the group of instances that have the value of incomplete at the other field.