Adaptive computer security

A computer implemented method of computer security for a host computer system in communication with remote computer systems, the method comprising:

• generating an attack map as a directed graph data structure modelling individual events leading to an exploitation of the host computer system, the attack map being generated in a training phase of the host computer system in which the host computer system is subjected to attacks by one or more attacking remote computer systems, and generating the attack map includes:
• collecting a log of each of a plurality of attack events occurring at the host computer system including network packets involved in each attack event,
• using stacked autoencoders to extract features from the log event in each attack event, and
• generating a directed graph representation based on each of the extracted features based on a temporal relationship between attack events for each extracted feature and a predefined definition of each of a plurality of attack patterns defining attack events and temporal relationships between attack events;
• and
• responsive to an occurrence of a new attack in the host computer system, the attack not resulting in the generation of attack events constituting a path through the attack map to a known exploitation, triggering regeneration of the attack map by the collecting, the using, and the generating including additional events generated in respect of the new attack.