Patent ID: 9571510
Date: 2017-02-14
CPC Classifications: H04L

Claim:
1. A computer-implemented method for protecting a computing system from a cyberattack, at least a portion of the method being performed by a computing device comprising at least one processor; the method comprising: identifying security-event data collected from a plurality of security events detected over a network; partitioning the security-event data into a set of single-dimensional security clusters that are each grouped by a common feature; determining that a subset of the single-dimensional security clusters exceed a threshold level of similarity relative to one another; grouping the subset of single-dimensional security clusters into a multi-dimensional security duster corresponding to a single threat source in response to determining that the subset of single-dimensional security dusters exceed the threshold level of similarity relative to one another; determining, based at least in part on grouping the subset of single-dimensional security dusters into the multi-dimensional security cluster, that the single threat source is responsible for at least some of the plurality of security events detected over the network; and performing a security action with respect to a computing system within the network to protect the computing system from a cyberattack perpetrated by the single threat source based at least in part on the determination that the single threat source is responsible for the at least some of the plurality of security events, wherein the security action comprises: compiling, from the multi-dimensional security cluster, information identifying the single threat source as being responsible for the plurality of security events: and transmitting, to a law enforcement organization, the information identifying the single threat source as being responsible for the plurality of security events to assist in a criminal prosecution of the single threat source.