Patent Document ID: 9166997
Application ID: 14031044
Patent Status: 1

Claim One:
1. A computer-implemented method for reducing false positives when using event-correlation graphs to detect attacks on computing systems, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting a suspicious event involving a first actor within a computing system; constructing, in response to detecting the suspicious event involving the first actor, an event-correlation graph, wherein the event-correlation graph comprises at least: a first node that represents the first actor; a second node that represents a second actor; an edge that interconnects the first node and the second node and represents an additional suspicious event involving the first actor and the second actor; comparing, at a server device that collects event information from a plurality of computing systems including the computing system, the event-correlation graph with at least one additional event-correlation graph that represents events generated on at least one additional computing system within the plurality of computing systems; determining that a similarity of the event-correlation graph and the additional event-correlation graph exceeds a predetermined threshold; classifying the suspicious event as benign based at least in part on determining that the similarity of the event-correlation graph and the additional event-correlation graph exceeds the predetermined threshold.