Patent Document ID: 20160359884
Application ID: 15231054
Patent Flag: 0

Claim One:
1. A computer-implemented method of classifying computer attack information performed by a computerized device, comprising: monitoring a set of entities and events in a computer network; determining by a computer a static distance between two entities, wherein the static distance is defined by the extent 1) that the two entities belong to the same organizational unit or department; and 2) that the two entities share common installed software components; and determining by the computer a dynamic distance between the two entities, wherein the dynamic distance is defined by the extent of 1) the number of common privilege changes on each of the entities 2) the number of common websites accessed by users of the entities; and 3) the number of common newly installed software applications on the entities; and combining the static distance and the dynamic distance to obtain each of a first entity distance and second entity distance, the first entity distance being computed without an event and the second entity distance being computed with the event; wherein if the second entity distance is lower than the first entity distance, the event is classified as malicious; outputting the result of the classification.