Cyber security restoration engine

Abstract

A cyber security restoration engine prioritizes nodes in a graph of nodes in a computer network or system that are involved in a cyber attack for remediation actions. The cyber security restoration engine performs this prioritization by, for each node, determining edge(s) that represent node interactions linking the node to other nodes in the graph; obtaining metadata indicative of a type of interaction between nodes connected by the edge and the roles of the nodes in that interaction; determining how severe the interaction represented by that edge is within the context of the cyber attack, based on the metadata of that edge; and determining a severity score for the node by combining the severity score for each of the edge(s) connected to the node. The cyber security restoration engine prioritizes nodes for remediation action based on the severity scores for the nodes.