Patent Document ID: 9832214
Application ID: 15231054
Patent Flag: 1

Claim One:
1. A computer-implemented method of classifying computer attack information performed by a computerized device, comprising: monitoring a set of entities and events in a computer network; determining by the computerized device a static distance between two entities, wherein the static distance is defined by an extent 1) that the two entities belong to a same organizational unit or department; and 2) that the two entities share common installed software components; and determining by the computerized device a dynamic distance between the two entities, wherein the dynamic distance is defined by an extent of 1) a number of common privilege changes on each of the entities 2) a number of common websites accessed by users of the entities; and 3) a number of common newly installed software applications on the entities; and combining the static distance and the dynamic distance to obtain each of a first entity distance and second entity distance, the first entity distance being computed without an event and the second entity distance being computed with the event; wherein when the second entity distance is lower than the first entity distance, the event is classified as malicious; outputting a result of the classification.