Threat detection network

A method for monitoring a security threat pertaining to a computer network, wherein the threat detection network comprises a back end system and a plurality of sensors coupled to the back end system via a communication network,

• wherein the method comprises, in said plurality of sensors, the following:
• collecting, in a respective sensor, data that is descriptive of respective occurrences of one or more predefined events in a respective one of a plurality of nodes of the computer network, wherein each of said events involves a respective interaction of a subject entity operating in the respective node with an object entity associated with the respective node,
• applying, in the respective sensor, one or more predefined anomaly detection (AD) models to determine a respective anomaly detection score for a plurality of interactions captured in the collected data,
• arranging, in the respective sensor, at least some of the interactions captured in the collected data into a local activity graph comprising interactions between plural subject entities operating in the respective node with one or more object entities associated with the respective node, and
• selectively transmitting, from the respective sensor, one or more portions of the local activity graph as respective node status data to the back end system, the one or more sub-graphs chosen in dependence of the detection anomaly scores determined for the respective interactions captured in the local activity graph, the one or more portions comprising sub-graphs of the local activity graph;
• and
• wherein the method further comprises deriving, in the back end system, based on respective node status data received from one or more of said plurality of sensors, one or more security parameters that are descriptive of the security threat pertaining to the computer network.