Patent attributes
A system includes a memory and at least one processor to continually analyze at least one of metrics, events, and conditions for indications of an attack in a computer network, determine a change in the at least one of metrics, events, and conditions in the computer network, detect the attack in the computer network based on the change in the at least one of metrics, events, and conditions in the computer network, analyze the at least one of metrics, events, and conditions in the computer network and determine that at least one hardware device has been infected, restrict access to the at least one hardware device that has been infected, and generate a copy of data that was created before the attack and associated with the at least one hardware device that has been infected.
