A computer implemented method of computer security for a host computer system in communication with remote computer systems, the method comprising: generating an attack map as a directed graph data structure modelling individual events leading to an exploitation of the host computer system, the attack map being generated in a training phase of the host computer system in which the host is subjected to attacks by one or more attacking remote computer systems, and generating the attack map includes the steps of: a) collecting a log of each of a plurality of attack events occurring at the host including network packets involved in each attack event; b) using stacked autoencoders to extract features from the log event in each attack; c) generating a directed graph representation based on each of the extracted features based on a temporal relationship between events for each extracted feature and a predefined definition of each of a plurality of attack patterns defining events and temporal relationships between events, determining a subset of nodes in the attack map corresponding to events in one or more attacks such that each of the predetermined attack patterns involves at least one of the nodes in the subset; determining a component of the host computer system involved in each event represented by each of the nodes in the subset; and deploying one or more security facilities at each of the determined components of the host computer system so as to mitigate attacks according to each of the attack patterns. generating an attack map as a directed graph data structure modelling individual events leading to an exploitation of the host computer system, the attack map being generated in a training phase of the host computer system in which the host is subjected to attacks by one or more attacking remote computer systems, and generating the attack map includes the steps of: a) collecting a log of each of a plurality of attack events occurring at the host including network packets involved in each attack event; b) using stacked autoencoders to extract features from the log event in each attack; c) generating a directed graph representation based on each of the extracted features based on a temporal relationship between events for each extracted feature and a predefined definition of each of a plurality of attack patterns defining events and temporal relationships between events, a) collecting a log of each of a plurality of attack events occurring at the host including network packets involved in each attack event; b) using stacked autoencoders to extract features from the log event in each attack; c) generating a directed graph representation based on each of the extracted features based on a temporal relationship between events for each extracted feature and a predefined definition of each of a plurality of attack patterns defining events and temporal relationships between events, determining a subset of nodes in the attack map corresponding to events in one or more attacks such that each of the predetermined attack patterns involves at least one of the nodes in the subset; determining a component of the host computer system involved in each event represented by each of the nodes in the subset; and deploying one or more security facilities at each of the determined components of the host computer system so as to mitigate attacks according to each of the attack patterns.