Abstract: A method, apparatus and computer program product for managing security threats to a distributed network. A set of events are aggregated from a plurality of event sources in the network for each of a set of security threats to the network. A magnitude of a characteristic of each of the set of security threats is determined. Each of the set of security threats is represented as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic. A security action is taken based on the determined magnitude of one of the set of security threats.

Abstract: A method, apparatus and computer program product for managing security threats to a distributed network. A set of events are aggregated from a plurality of event sources in the network for each of a set of security threats to the network. A magnitude of a characteristic of each of the set of security threats is determined. Each of the set of security threats is represented as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic. A security action is taken based on the determined magnitude of one of the set of security threats.

Abstract: A system comprising: a software agent stored on a non-transient computer-readable storage medium in a motor vehicle, the software agent comprising instructions that cause a processor in the motor vehicle to: monitor, in real time (i) events occurring in an operating system of the motor vehicle and any application running thereon, (ii) messages transmitted by Electronic Control Units (ECUs) of the motor vehicle over an in-vehicle network of the motor vehicle, and (iii) network activity between the motor vehicle and external network resources; detect suspicious events, messages, and network activity, in the monitored events, messages, and network activity, respectively; repeatedly execute Stateful Event Processing (SEP) on a combination of the detected suspicious events, messages, and network activity; and infer potential computer security threats based on results of the SEP.