Cyber security restoration engine

An apparatus, comprising:

• a cyber security restoration engine to prioritize nodes in a graph of nodes in a computer network or system that are involved in a cyber attack for remediation actions, for each node, by being configured to perform operations as follows:
• determine one or more edges linking the node to other nodes in the graph, the edges representing interactions between two nodes;
• obtain metadata for each of the one or more edges, the metadata being indicative of a type of interaction between two nodes connected by the edge and the roles of the two nodes in that interaction;
• determine, for each of the one or more edges, a severity score representing how severe the interaction represented by that edge is within the context of the cyber attack, based on the metadata of that edge;
• and
• determine a severity score for the node by combining the severity score for each of the one or more edges connected to the node;
• wherein the cyber security restoration engine is further configured to prioritize nodes for remediation action based on the severity scores for the nodes, with nodes having a higher severity score being prioritized above nodes having a lower severity score;
• and
• where any instructions for the cyber security restoration engine are stored in an executable format on one or more non-transitory computer readable mediums, which are executable by one or more processors.