Systems and methods for detecting malicious computing events

A system for detecting malicious computing events, the system comprising:

• a physical processor;
• a scoring module, executed by the physical processor, that determines, for each of a plurality of computing events detected within an enterprise:
• an initial disposition score that indicates a likelihood that the computing event is malicious based on currently-available security information;
• and
• an updated disposition score based on new security information that was not available when the initial disposition score was determined;
• a classification module, executed by the physical processor, that determines, for each computing event:
• an initial classification as malicious or non-malicious by comparing the initial disposition score of the computing event with a threshold disposition score that represents a minimum disposition score indicative of malicious computing events;
• and
• an updated classification by comparing the updated disposition score of the computing event with the threshold disposition score;
• a calculation module, executed by the physical processor, that calculates a degree to which the threshold disposition score correctly identifies malicious computing events by:
• determining a false positive rate produced by the threshold disposition score based on a percentage of computing events that have an initial classification of malicious and an updated classification of non-malicious;
• and
• determining a false negative rate produced by the threshold disposition score based on a percentage of computing events that have an initial classification of non-malicious and an updated classification of malicious;
• and
• a security module, executed by the physical processor, that protects the enterprise from security threats by:
• receiving, from the enterprise, a desired ratio of false positives to false negatives detected within the enterprise;
• determining, based on a retrospective analysis of the initial disposition scores and the updated disposition scores of the plurality of computing events, an optimal threshold disposition score that produces the desired ratio of false positives to false negatives;
• and
• implementing the optimal threshold disposition score within the enterprise.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• determine, for each of a plurality of computing events detected within an enterprise, an initial disposition score that indicates a likelihood that the computing event is malicious based on currently-available security information;
• determine an initial classification of each computing event as malicious or non-malicious by comparing the initial disposition score of each computing event with a threshold disposition score that represents a minimum disposition score indicative of malicious computing events;
• determine, for each computing event after the initial disposition score for the computing event has been determined:
• an updated disposition score based on new security information that was not available when the initial disposition score was determined;
• and
• an updated classification by comparing the updated disposition score with the threshold disposition score;
• calculate a degree to which the threshold disposition score correctly identifies malicious computing events by:
• determining a false positive rate produced by the threshold disposition score based on a percentage of computing events that have an initial classification of malicious and an updated classification of non-malicious;
• and
• determining a false negative rate produced by the threshold disposition score based on a percentage of computing events that have an initial classification of non-malicious and an updated classification of malicious;
• and
• protect the enterprise from security threats by:
• receiving, from the enterprise, a desired ratio of false positives to false negatives detected within the enterprise;
• determining, based on a retrospective analysis of the initial disposition scores and the updated disposition scores of the plurality of computing events, an optimal threshold disposition score that produces the desired ratio of false positives to false negatives;
• and
• implementing the optimal threshold disposition score within the enterprise.