Abstract: A method and system for identifying cyber-attacks on a computing device of a protected computer network, by at least one processor may include: monitoring network traffic via a gateway of the protected network; extracting one or more indicators of compromise (IOCs) from the monitored network traffic; classifying the extracted IOCs to produce one or more generalized IOC (GIOC) data elements; chronologically aggregating the one or more GIOC data elements, to produce at least one sequence data structure; and analyzing the at least one sequence data structure, based on a rule-base data structure, to identify an indication of attack (IOA) on a computing device of the protected computer network.

Abstract: A method and system for identifying cyber-attacks on a computing device of a protected computer network, by at least one processor may include: monitoring network traffic via a gateway of the protected network; extracting one or more indicators of compromise (IOCs) from the monitored network traffic; classifying the extracted IOCs to produce one or more generalized IOC (GIOC) data elements; chronologically aggregating the one or more GIOC data elements, to produce at least one sequence data structure; and analyzing the at least one sequence data structure, based on a rule-base data structure, to identify an indication of attack (IOA) on a computing device of the protected computer network.