1. A method comprising: receiving at a security analysis device, a plurality of indicators of compromise (IOCs) associated with an entity, said IOCs based on a system event, network traffic classification, or malware artifact, wherein said IOCs are received from a plurality of security devices, the security analysis device operable to process and analyze said IOCs; sorting at the security analysis device, said IOCs based on a time of occurrence of each of said IOCs; creating a representation of transitions between said IOCs at the security analysis device, wherein creating a representation of transitions comprises aggregating said IOCs related to an entity and computing transitions for pairs of IOCs, wherein computing comprises creating a transition matrix computed separately for each entity, wherein rows and columns of the matrix correspond to individual IOCs; generating at the security analysis device, a feature vector representing inner dependencies among the IOCs for the entity based on said representation of transitions, said representation of transitions describing individual transitions and inner dependencies among the indicators to reconstruct a possible attack vector; and transmitting said feature vector to a classifier, said feature vector configured for use by the classifier in identifying malicious entities.