Network health scoring

Abstract

The present disclosure provides methods of responding to a malware infection, one method comprising: receiving a graph representing a computer network infected with malware, wherein nodes of the graph represent devices of the computer network and edges of the graph represent connections between the devices; identifying a plurality of actions for responding to the malware; for each action of the plurality of actions: generating an updated graph by simulating the action and subsequent propagation of the malware in the computer network; and determining a health score for the computer network based on the updated graph, wherein calculating the health score comprises determining a contribution value for each node of the updated graph; identifying and selecting the action of the plurality of actions in dependence of the health score; and performing the identified action on the computer network.

Dependencies are inferred from the claim text.