CPC H04L 63/02 (2013.01) [H04L 63/1425 (2013.01); H04L 63/145 (2013.01); G06T 11/206 (2013.01); G06T 2200/24 (2013.01)] | 20 Claims |
1. A method comprising:
detecting network incidents associated with a user device, the network incidents relating to security threats in a network;
grouping the network incidents into one or more groups based on types of the security threats associated with the network incidents;
generating a graph for a group of the one or more groups, the graph including a plurality of nodes, each node representing a behavior indicator associated with the group, wherein generating the graph includes:
assigning an edge to connect a first node and a second node when the first node and the second node correspond to behavior indicators that belong to a same network incident, and
assigning a weight to the edge based on a number of co-occurrences of the first node and the second node in the group; and
displaying the graph on a graphical user interface.
|