Detection and identification of targeted attacks on a computing system

A computer implemented method, comprising:

• receiving attack data indicative of malicious activity on a monitored computing system;
• applying a target filter to the attack data to cluster the attack data based on attack targets;
• identifying the malicious activity as a targeted attack if the malicious activity preferentially attacks a target cluster;
• if the malicious activity is identified as a targeted attack, then obtaining attack characteristics indicative of the targeted attack and obtaining attacker characteristics indicative of an identity of an attacker corresponding to the targeted attack;
• and
• controlling a user interface mechanism to generate an interactive indication of the targeted attack including the attack characteristics and the attacker characteristics.

A computing system, comprising:

• signal enrichment logic configured to receive attack data indicative of malicious activity on a monitored computing system and to obtain enrichment properties corresponding to the attack data, the enrichment properties being indicative of characteristics of attack targets, the signal enrichment logic being configured to add the enrichment properties to the attack data;
• target filtering logic that applies a target filter to the attack data and the enrichment properties to cluster the attack data based on attack targets;
• a malicious activity security system that identifies the malicious activity as a targeted attack if the malicious activity preferentially attacks a target cluster, and that obtains attack characteristics indicative of the targeted attack and attacker characteristics indicative of an identity of an attacker corresponding to the targeted attack;
• and
• control signal generator logic that controls a user interface mechanism to generate an interactive indication of the targeted attack including the attack characteristics and the attacker characteristics.
• to identify the malicious activity as a targeted attack.