Determining the impact of malicious processes in it infrastructure

A system, comprising:

• a processor configured to:
• track data communication between a plurality of computer processes;
• identify a set of anomalous computer processes of the plurality of computer processes, wherein the set of anomalous computer processes includes a first computer process that is an anomalous computer process with respect to at least some of the plurality of computer processes;
• identify a second computer process of the plurality of computer processes that is affected by the anomalous computer process based on at least a portion of the tracking, wherein the second computer process is not one of the identified set of anomalous computer processes;
• and
• provide an indication of the identified second computer process that is affected by the anomalous computer process;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

• tracking data communication between a plurality of computer processes;
• identifying a set of anomalous computer processes of the plurality of computer processes, wherein the set of anomalous computer processes includes a first computer process that is an anomalous computer process with respect to at least some of the plurality of computer processes;
• receiving, from a user interface, a confirmation that the anomalous computer process is malicious;
• in response to receiving the confirmation, identifying a second computer process of the plurality of computer processes that is affected by the anomalous computer process based on at least a portion of the tracking, wherein the second computer process is not one of the identified set of anomalous computer processes;
• and
• providing an indication of the identified second computer process that is affected by the anomalous computer process.