Patent Document ID: 10027698
Application ID: 14975502

Base Claim:
1. A method for managing an attack on a computer system, the method comprising: identifying, by a computer, actions taken by an adversary in the computer system; identifying, by the computer, links connecting the actions over time using an ontology defining linking rules for linking the actions over time; creating, by the computer, a graph of the actions with the links connecting the actions over time, wherein the graph shows a number of patterns of behavior for the adversary, and wherein the graph is a linkograph; identifying, by the computer, a protective action to take with respect to the computer system using the graph of the actions taken by the adversary; identifying, by the computer, a number of linkographs that are possible from the actions taken by the adversary and the linking rules in the ontology; identifying, by the computer, metrics for the number of linkographs that indicate a likelihood that the actions taken by the adversary is the attack, wherein the metrics are selected from at least one of a ratio of links in the linkograph to total possible links, a ratio of the commands in the event data that belong to an action in an abstraction class to a subset of the commands in the event data, a ratio of backlinks present in the linkograph for the actions in the linkograph to a number of possible back links in the linkograph, or Shannon entropy for each possible sub-linkograph in the linkograph; and wherein creating, by the computer, the linkograph of the actions with the links connecting the actions over time comprises identifying, by the computer, the linkograph based on the metrics for the number of linkographs.

---

Claim 8:
8. The method of claim 1 , wherein the steps are performed during a time selected from at least one of during the attack or after the attack.