Abstract: A cyber security system includes an attribute extractor to extract an event from a data resource, the event including an identifier associated with an originator and including an attribute; an attribute router in communication with the attribute extractor; an inference engine in communication with the attribute router and having an associated lattice, the lattice to receive the attribute and to generate a predictive event, the attribute router to route the event to the inference engine; and a monitoring server in communication with the inference engine, the inference engine to provide the predictive event to the monitoring server.

Abstract: A cyber security system includes a plurality of event sensors to detect events, a plurality of inference servers, and a server in communication with the plurality of inference servers. Each inference server of the plurality is in communication with a subset of event sensors of the plurality of event sensors. Each inference server has a portion of an event lattice and is to compare the event detected by the subset of event sensors to the event lattice. Each inference server is to identify an originator having a behavior pattern indicative of an attack and communicating an identifier associated with the originator. The server is to provide an interface indicating the behavior pattern indicative of an attack and the identifier of the originator.