Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for processing event log data. An example event log processing method includes receiving an event log comprising a plurality of event records describing events that have occurred on each of one or more computer systems over a period of time; converting the event log into a graph, comprising: normalizing the plurality of event records, including anonymizing a unique identifier value in each event record and replacing a variable value in each event record with a predetermined value; representing each normalized event record as one or more nodes in the graph; and generating a plurality of event clusters, wherein each event cluster includes an aggregated group of nodes and is generated based on common attributes of and hierarchical relationships between the normalized event records represented by the nodes in the aggregated group.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for processing event log data. An example event log processing method includes receiving an event log comprising a plurality of event records describing events that have occurred on each of one or more computer systems over a period of time; converting the event log into a graph, comprising: normalizing the plurality of event records, including anonymizing a unique identifier value in each event record and replacing a variable value in each event record with a predetermined value; representing each normalized event record as one or more nodes in the graph; and generating a plurality of event clusters, wherein each event cluster includes an aggregated group of nodes and is generated based on common attributes of and hierarchical relationships between the normalized event records represented by the nodes in the aggregated group.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for processing event log data. An example event log processing method includes receiving an event log comprising a plurality of event records describing events that have occurred on each of one or more computer systems over a period of time; converting the event log into a graph, comprising: normalizing the plurality of event records, including anonymizing a unique identifier value in each event record and replacing a variable value in each event record with a predetermined value; representing each normalized event record as one or more nodes in the graph; and generating a plurality of event clusters, wherein each event cluster includes an aggregated group of nodes and is generated based on common attributes of and hierarchical relationships between the normalized event records represented by the nodes in the aggregated group.

Abstract: A system and method for executing computer virus definitions containing general purpose programming language extensions is described. One or more virus definition records are stored in a computer virus data file. Each virus definition record includes an identifier, a virus detection section and an extension sentence. The identifier uniquely identifies a computer virus. The virus detection section includes object code providing operations to detect the identified computer virus within a computer system. The extension sentence includes object code providing reusable operations implemented in a general purpose computing language. For each virus definition record, at least one of the object code of the virus detection section and the extension sentence is interpreted.

Abstract: A system and method for executing computer virus definitions containing general purpose programming language extensions is described. One or more virus definition records are stored in a computer virus data file. Each virus definition record includes an identifier, a virus detection section and an extension sentence. The identifier uniquely identifies a computer virus. The virus detection section includes object code providing operations to detect the identified computer virus within a computer system. The extension sentence includes object code providing reusable operations implemented in a general purpose computing language. For each virus definition record, at least one of the object code of the virus detection section and the extension sentence is interpreted.