7. The computer-implemented method of claim 1 , further comprising: calculating, based at least in part on the adjusted suspiciousness score, an attack score for the event-correlation graph; determining that the attack score is greater than a predetermined threshold; determining, based at least in part on the attack score being greater than the predetermined threshold, that the suspicious event comprises an attack on the computing system; reporting the attack on the computing system.
1. A computer-implemented method for adjusting suspiciousness scores in event-correlation graphs, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting a suspicious event involving a first actor and a second actor within a computing system, wherein the suspicious event could not be individually classified as definitively malicious; constructing, after the suspicious event involving the first actor and the second actor is detected, an event-correlation graph, wherein the event-correlation graph comprises at least: a representation of the first actor; a representation of the suspicious event, wherein the representation of the suspicious event and the representation of the first actor are interconnected; a representation of the second actor, wherein the representation of the second actor and the representation of the suspicious event are interconnected; a representation of an additional suspicious event involving the first actor and an additional actor; a representation of the additional actor, wherein: the representation of the first actor and the representation of the additional suspicious event are interconnected; the representation of the additional actor and the representation of the additional suspicious event are interconnected; the additional suspicious event could not be individually classified as definitively malicious; each suspicious event represented in the event-correlation graph could not be individually classified as definitively malicious; adjusting a suspiciousness score associated with at least one of an actor represented in the event-correlation graph and a suspicious event represented in the event-correlation graph based at least in part on a suspiciousness score associated with at least one other actor or suspicious event represented in the event-correlation graph such that the adjusted suspiciousness score is influenced by the suspiciousness score associated with the at least one other actor or suspicious event.