Inferring temporal relationships for cybersecurity events

An apparatus, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor to manage a security event, the computer program instructions including program code configured to:
• receive a description of a security event;
• extract from the description one or more security entities;
• extract temporal information from the description;
• process the extracted temporal information according to a set of temporal markers;
• responsive to the processing, determining a time value marker of the security exploit;
• and
• associate the time value marker to the one or more security entities;
• and
• perform a security event management operation on the security event based at least in part on the time value marker.

A computer program product in a non-transitory computer readable medium for use in a data processing system to manage a security event, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to:

• receive a description of a security event;
• extract from the description one or more security entities;
• extract temporal information from the description;
• process the extracted temporal information according to a set of temporal markers;
• responsive to the processing, determine a time value marker of the security exploit;
• and
• associate the time value marker with the one or more security entities;
• and
• perform a security event management operation on the security event based at least in part on the time value marker.