Identifying an attacked computing device

A computer system comprising:

• a processor integrated into a circuit and memory storing computer program code including instructions for identifying an attacked computing device in a system of network-connected computing devices providing a plurality of computing services, including:
• wherein the instructions, when executed on the processor, cause the computer system to implement:
• receiving a first data structure including data modeling relationships between vulnerabilities of computing services in a first proper subset of the plurality of computing services and exploitation of the vulnerabilities to identify one or more series of exploits involved in a network attack;
• receiving a second data structure including data modeling the computing devices in the system including network connections of each computing device;
• and
• comparing the first data structure and the second data structure to identify the attacked computing device as an intermediate device in communications between at least two computing services in any of the one or more series of exploits by following each of the one or more series of exploits, associating each exploit with a particular computing device of the computing devices, and identifying any intermediate device in communication between exploited devices as the attacked computing device.

A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed by a processor integrated into a circuit thereon, cause the computer system to identify an attacked computing device in a system of network-connected computing devices providing a plurality of computing services, including:

• wherein the computer program code, when executed on the processor, cause the computer system to implement:
• receiving a first data structure including data modeling relationships between vulnerabilities of computing services in a first proper subset of the plurality of computing services and exploitation of the vulnerabilities to identify one or more series of exploits involved in a network attack;
• receiving a second data structure including data modeling the computing devices in the system including network connections of each computing device;
• and
• comparing the first data structure and the second data structure to identify the attacked computing device as an intermediate device in communications between at least two computing services in any of the one or more series of exploits by following each of the one or more series of exploits, associating each exploit with a particular computing device of the computing devices, and identifying any intermediate device in communication between exploited devices as the attacked computing device.