Graph-based fusing of heterogeneous alerts

A system for reporting anomalous events, comprising:

• a clustering module comprising a processor configured to perform intra-host clustering on a set of alerts based on a process graph that models states of process-level events in a network, to perform hidden relationship clustering on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters, and to perform inter-host clustering on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network;
• and
• a user interface configured to report inter-host clustered alerts that exceed a threshold level of trustworthiness.