Use of graph neural networks to classify, generate, and analyze synthetic cyber security incidents

This invention describes a cybersecurity system that uses a specialized artificial intelligence called a Graph Neural Network (GNN) to understand and respond to ongoing cyberattacks. The system analyzes events as they happen during an incident, then works with a scoring system to provide useful information to a user. Specifically, the GNN can predict how an attack might end, classify the type of incident and rate its severity, or create data representations for further analysis. The claims narrow this to a cyber security appliance that reports actionable information to a user, focusing on either generating predictive graphs of attack evolution or classifying and scoring incidents.