Abstract: An apparatus for storing a set of events, is provided, the apparatus comprising one or more circuitry configured to: receive an electronic message comprising information of a first event between a first party and a second party, the first event being initiated by the first party; determine whether a record of the first event exists in a first storage unit; wherein when it is determined that the record of the first event does not exist, the one or more circuitry is configured to: determine whether any subsequent events between the second party and a third party are initiated by the second party within a predetermined time of the first event; and store an association between the second party and a first set of events, the first set of events comprising the first event and the subsequent event, in a second storage unit, when the subsequent event is initiated within the predetermined time.

Abstract: A method, apparatus and computer program product for reporting an exchange of messages between nodes in a network is provided by the present disclosure, the method comprising: receiving from a first device, using circuitry, a request for data for a target node, the data indicative of an exchange of messages between nodes in a network linked to the target node determining, by the circuitry, whether a request for data for the target node has previously been received; and, when a request for data for the target node has previously been received, the method comprises: building, by the circuitry, data indicative of the exchange of messages between nodes in the network linked to the target node; identifying, by the circuitry, a new portion of the data based on a comparison of the data with previous data which has been built for the target node; and reporting to the first device, by the circuitry, the new portion of the data.

Abstract: The present disclosure concerns a computer-implemented method for reconstructing a dataset after detection of a network security threat in a network. The method comprises: determining a maximum flow for returning data associated with the network security threat to a source dataset via each of a plurality of paths through which the data has passed from the source dataset to the destination dataset; starting from the destination dataset, determining the data to be transferred to each dataset in the plurality of paths between the destination dataset and the one or more source datasets such that the data can be returned to the one or more source datasets, the data transferred in each path not exceeding the determined maximum flow for the path; adding the details of the determined amount of data to be transferred to a forensic report; and outputting the forensic report.

Abstract: The present disclosure concerns a computer-implemented method for forensically analysing and determining a network associated with a network security threat. The method comprises: obtaining details of a flagged network event comprising data associated with a network security threat, the network event being between a first dataset and a destination dataset; tracing the data associated with the network security threat from the first dataset to a further dataset, the tracing involving obtaining details of at least one past network event between the first dataset and the further dataset; comparing details of the further dataset to predefined criteria to identify whether the further dataset is an intermediate dataset or a source dataset from which the data originated and adding the details of the further dataset to a forensic report; outputting the forensic report.

Abstract: An apparatus for storing a set of events, is provided, the apparatus comprising one or more circuitry configured to: receive an electronic message comprising information of a first event between a first party and a second party, the first event being initiated by the first party; determine whether a record of the first event exists in a first storage unit; wherein when it is determined that the record of the first event does not exist, the one or more circuitry is configured to: determine whether any subsequent events between the second party and a third party are initiated by the second party within a predetermined time of the first event; and store an association between the second party and a first set of events, the first set of events comprising the first event and the subsequent event, in a second storage unit, when the subsequent event is initiated within the predetermined time.