Internet security firm Mandiant, which was hired by the Times to trace the attack, followed the hackers' movements for four months, to try to establish a pattern and block them.
It builds the patterns up slowly, one block at a time, but rarely does it require the kind of intuitive BIG PATTERN RECOGNITION that macroscopic learning demands.