Patent Document ID: 9628506
Application ID: 14752146
Patent Flag: 1

Claim One:
1. A computer-implemented method for detecting security events, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying facets of candidate security events detected by a network security system, the candidate security events comprising network messages; assigning each of the facets of the candidate security events to one of multiple groups of facets to create permutations of the facets; comparing, for each group of facets, the candidate security events with each other according to a similarity algorithm that indicates similarity between the candidate security events, the similarity algorithm indicating similarity according to the facets specific to the respective group; generating, for each group of facets, a weak classifier for detecting security events based on a nearest neighbor graph that connects each node of the graph to a nearest neighbor according to the respective similarity algorithm, the nearest neighbor graph indicating the network messages as nodes; and performing, by the network security system, a remedial action in response to classifying a candidate security event as a security threat by applying the weak classifiers for the groups of facets to the candidate security event by giving each of the weak classifiers a vote on a security score for the candidate security event.