Network protection

A computer implemented method for protecting a network comprising a plurality of computer systems, the method comprising:

• receiving an indication that one or more anomalies which have been determined to be associated with a threat have been detected within the network;
• generating a model of the network for simulating propagation of the threat within the network, the model comprising one or more properties representing an incidence of the threat within the network;
• training an intelligent agent to generate a response to the threat, the intelligent agent being trained using a reinforcement learning technique by using the model of the network to evaluate effectiveness of taking different actions to counter the threat based on a simulated propagation of the threat within the model, the simulated propagation being determined based on a threat propagation model and the one or more properties representing the incidence of the threat within the network;
• using the intelligent agent to determine a response to the threat, the response comprising one or more actions to be taken in relation to the network;
• and
• applying the response to the network by causing the one or more actions to be taken in relation to the network.