Network protection system and threat correlation engine

A non-transitory computer-readable storage medium with an executable program stored thereon for processing of network traffic between one or more networked devices, wherein at least one of the networked devices is a monitoring agent configured to monitor data traffic and recognize aggressor events that are potential threats and another or a same one of the networked devices is an interdiction agent, wherein the program comprises:

• a code segment for receiving information from the monitoring agent regarding an event recognized by the monitoring agent;
• a code segment for retrieving an event score for the event from a risk scoring database by looking up a risk scoring matrix in the scoring database associated with an event type of the event and determining the event score from the risk scoring matrix based on a destination of the event and a number of occurrences of the event, wherein the risk scoring matrix comprises different event score values for different combinations of a number of destinations of the event and a number of occurrences of the event;
• a code segment for updating a risk score stored in an aggressor threat database by adding the event score to the risk score, wherein the risk score is associated in the aggressor threat database with the aggressor and the event type;
• and
• a code segment for, when the risk score is at or above a critical threshold, sending instructions to the interdiction agent to take protective action or to execute a defensive response associated with data traffic that is both of the event type and from the aggressor.

A computer-implemented method for processing of network traffic between one or more networked devices, wherein at least one of the networked devices is a monitoring agent configured to monitor data traffic and recognize aggressor events that are potential threats and another or a same one of the networked devices is an interdiction agent, wherein the method comprises:

• receiving, with a processor of a threat correlation device, information from the monitoring agent regarding an event recognized by the monitoring agent;
• retrieving, with the processor, an event score for the event from a risk scoring database by looking up a risk scoring matrix in the scoring database associated with an event type of the event and determining the event score from the risk scoring matrix based on a destination of the event and a number of occurrences of the event, wherein the risk scoring matrix comprises different event score values for different combinations of a number of destinations of the event and a number of occurrences of the event;
• updating, with the processor, a risk score stored in an aggressor threat database by adding the event score to the risk score, wherein the risk score is associated in the aggressor threat database with the aggressor and the event type;
• decrementing the risk score by a predetermined amount upon the passage of a predetermined amount of time or upon receiving a predetermined amount of data traffic;
• and
• sending, when the risk score is at or above a critical threshold, instructions from the processor to the interdiction agent to take protective action or to execute a defensive response associated with data traffic that is both of the event type and from the aggressor.