Patent ID: 7926111

Claim:
A method of determining a group of related entities of interest in one or more processing systems, wherein the method comprises the steps of: (a) identifying, by a processing system, using a second rule, a starting entity from one or more entities in the one or more processing systems, wherein the second rule comprises an event record indicative of at least one past event that occurred in the processing systems; (b) obtaining, by the processing system, based on an entity property of the starting entity, a first rule for identifying at least one related entity; (c) identifying, by the processing system, using the first rule, the at least one related entity relative to the starting entity; (d) determining, by the processing system, if an end condition is satisfied; (e) if the end condition is satisfied, transferring data indicative of the at least one identified related entity to a server processing system; (f) if the end condition is not satisfied, setting the at least one related entity as the starting entity; (g) repeating steps (b), (c), (d), (e), and (f) until the end condition is satisfied; (h) receiving, by a server processing system, suspicious entity data indicative of one or more suspicious entities in the one or more processing systems; (i) determining, by the server processing system, a quantity of malicious assessment rules satisfied by the one or more suspicious entities; (j) assigning, by the server processing system, a malicious value to the one or more suspicious entities based on the quantity of malicious assessment rules satisfied by the one or more suspicious entities, wherein the malicious value indicates a potential maliciousness of the one or more suspicious entities; (k) determining, by the server processing system, using a set of malicious assessment rules, the suspicious entity data, and the assigned malicious values, the one or more malicious entities; (l) generating instructions for quarantining the one or more malicious entities on the one or more processing systems; and (m) transferring, to the one or more processing systems, the instructions.