Historic data breach detection

A computer system comprising:

• a processor and memory storing computer program code for detecting a data breach in a network-connected computing system by:
• storing, at a trusted secure computing device, at least a portion of network traffic communicated with the computer system;
• generating, by the trusted secure computing device, a copy of data distributed across a network;
• identifying, by the trusted secure computing device, information about a network attack stored in the copy of the data;
• generating, by the trusted secure computing device, a signature for the network attack based on the identified information about the network attack, the signature including rules for identifying the network attack in network traffic;
• and
• identifying an occurrence of the network attack in the stored portion of network traffic based on the generated signature.

A non-transitory computer-readable storage element storing computer program code to, when loaded into a computer system and executed thereon, cause the computer system to detect a data breach in a network-connected computing system by:

• storing, at a trusted secure computing device, at least a portion of network traffic communicated with the computer system;
• generating, by the trusted secure computing device, a copy of data distributed across a network;
• identifying, by the trusted secure computing device, information about a network attack stored in the copy of the data;
• generating, by the trusted secure computing device, a signature for the network attack based on the identified information about the network attack, the signature including rules for identifying the network attack in network traffic;
• and
• identifying an occurrence of the network attack in the stored portion of network traffic based on the generated signature.