Patent Document ID: 20150121518
Application ID: 14524145
Patent Flag: 0

Claim One:
1. A computer-implemented method for determining whether a computer network is compromised by unauthorized activity on the computer network, comprising: identifying, by a computer system, a behavioral anomaly of an entity on the computer network; classifying, by the computer system, the anomaly as a system event based on an assigned score for the anomaly being at least at a predetermined score threshold; updating, by the computer system, an incident based on at least one common parameter between the system event and other system events which comprise the incident, each system event of the incident including an assigned score from when the event was an anomaly; updating, by the computer system, a system status based on at least the incident, and assigning a system status score to the system status; and determining, by the computer system, whether the system status score is at least at a predetermined threshold system status score indicating that the computer network may be compromised.