Abstract: The disclosed systems and techniques apply innovative cross-disciplinary machine intelligence to security in computer networks to provide automated threat characterization. A process of successive abstraction is employed, adding progressively more information-rich semantic description and story-telling context to raw anomalous events. This descriptive information and narrative of sequences and connections enables network defenders to make faster, more accurate, and more complete decisions about where to direct their attention in order to identify and respond to the true threats before they accomplish their objectives.

Abstract: A method of determining a quantitative measure of the danger (a Trust/Risk) that a select network entity poses to the security and integrity of a communications network, the method includes setting a plurality of parameters. The parameters define the degree to which various behaviors within the communications network are considered usual or anomalous. Actual behavior of the select network entity is observed by watching network traffic using network packet-collection, recording packet properties, and using the packet properties to associate a select packet with the select network entity. Self-report messages broadcast by the select network entity are also observed. The Trust/Risk of the select network entity is then determined based on a comparison of the actual behavior to the self-report message and a comparison of the actual behavior to the plurality of parameters.