Identifying and eradicating the source of a malware attack

An apparatus, comprising:

• one or more processors;
• one or more memories coupled with the one or more processors;
• and
• instructions stored in the one or more memories and executable by the one or more processors to cause the apparatus to:
• obtain event data corresponding to events associated with a set of computing entities, wherein the events are initiated by respective initiator entities within the set of computing entities and affect one or more respective affected entities within the set of computing entities, and wherein the event data comprises respective event risk scores for at least some of the events;
• create, based at least in part on the event data, a graph comprising nodes representative of the set of computing entities and edges representative of the events, wherein the edges are between nodes corresponding to the respective initiator entities and the one or more respective affected entities for the events, and wherein at least some of the edges are associated with the respective event risk scores;
• and
• determine respective node risk scores for at least some nodes of the graph, wherein a respective node risk score for a node is based at least in part on one or more event risk scores associated with one or more edges connected to the node, wherein, to determine the respective node risk scores for at least some nodes of the graph, the instructions are executable by the one or more processors to cause the apparatus to:
• prune one or more non-anomalous edges from the graph to obtain a pruned graph based at least in part on respective edge risk scores for the one or more non-anomalous edges failing to satisfy a risk threshold;
• identify, using the pruned graph, one or more anomalous nodes present in the pruned graph based at least in part on the one or more anomalous nodes having respective node risk scores that satisfy the risk threshold;
• perform a forward tracking procedure by traversing at least a portion of the graph to determine respective node risk scores for one or more previously unscored nodes;
• determine, based at least in part on the forward tracking procedure, a group of computing entities of the set of computing entities affected by a malware attack that have latent malware, wherein the latent malware comprises malware that is inactive malware present on the group of computing entities;
• and
• output a first indication of one or more computing entities corresponding to the one or more anomalous nodes and a second indication of the group of computing entities affected by the latent malware.

A non-transitory computer-readable medium storing code, the code comprising instructions executable by one or more processors to:

• obtain event data corresponding to events associated with a set of computing entities, wherein the events are initiated by respective initiator entities within the set of computing entities and affect one or more respective affected entities within the set of computing entities, and wherein the event data comprises respective event risk scores for at least some of the events;
• create, based at least in part on the event data, a graph comprising nodes representative of the set of computing entities and edges representative of the events, wherein the edges are between nodes corresponding to the respective initiator entities and the one or more respective affected entities for the events, and wherein at least some of the edges are associated with the respective event risk scores;
• and
• determine respective node risk scores for at least some nodes of the graph, wherein a respective node risk score for a node is based at least in part on one or more event risk scores associated with one or more edges connected to the node, wherein, to determine the respective node risk scores for at least some nodes of the graph, the instructions are executable by one or more processors to:
• prune one or more non-anomalous edges from the graph to obtain a pruned graph based at least in part on respective edge risk scores for the one or more non-anomalous edges failing to satisfy a risk threshold;
• identify, using the pruned graph, one or more anomalous nodes present in the pruned graph based at least in part on the one or more anomalous nodes having respective node risk scores that satisfy the risk threshold;
• perform a forward tracking procedure by traversing at least a portion of the graph to determine respective node risk scores for one or more previously unscored nodes;
• determine, based at least in part on the forward tracking procedure, a group of computing entities of the set of computing entities affected by a malware attack that have latent malware, wherein the latent malware comprises malware that is inactive malware present on the group of computing entities;
• and
• output a first indication of one or more computing entities corresponding to the one or more anomalous nodes and a second indication of the group of computing entities affected by the latent malware.