Patent Document ID: 9661019
Application ID: 13953457
Patent Flag: 1

Claim One:
1. A method, comprising: performing, by one or more computing devices: receiving a message comprising information indicative of an event detected on one of a plurality of nodes in a distributed computing system; accessing a knowledge base comprising information associated with known computing system attack patterns; classifying the event as being representative of one of the known computing system attack patterns or as being representative of an unknown attack pattern, dependent, at least in part, on said accessing; and initiating a response to the event comprising modifying operation of one or more of the nodes in the distributed computing system, wherein the response to the event is dependent on said classifying; wherein in response to classifying the attack as an unknown attack pattern, said initiating a response further comprises one or more of: performing a clustering analysis to identify a known attack pattern sharing at least some characteristics with the unknown attack pattern, randomly selecting a response action, or simulating the unknown attack pattern.