System and method for determining a decayed threat score
AssigneeSymantec Corporation
InventorsShang-Chieh Wu, Ranjani Gunupudi, Rehan Jalil
Life of this patent
Estimating the term…
Abstract
According to one embodiment, a computer-implemented method performed by a computing device comprising at least one processor, the method comprising determining a threat score for a user action in a computer application and calculating a decayed threat score based on the determined threat score and a damping factor. The threat score being indicative of a risk presented by the user action, the decayed threat score being a modified threat score for the user action, and the damping factor being a constant value used to reduce the determined threat score.
Claims10
A computerized system comprising:
- a computer processor;
- a memory configured to store instructions, the instructions when executed by the computer processor are operable to:
- determine a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;
- calculate a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;
- determine an aggregate threat score based on the decayed threat score;
- and
- suspend, based on the aggregate threat score, user activity corresponding to one or more of:
- a particular computer user;
- a particular computer application;
- and
- a particular activity.
A computer-implemented method performed by a computing device comprising at least one processor, the method comprising:
- determining a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;
- calculating a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;
- determining an aggregate threat score based on the decayed threat score;
- and
- suspending, based on the aggregate threat score, user activity corresponding to one or more of:
- a particular computer user;
- a particular computer application;
- and
- a particular activity.
One or more computer-readable non-transitory storage media in one or more computing systems, the media embodying logic that is operable when executed by a computer processor to:
- determine a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;
- calculate a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;
- determine an aggregate threat score based on the decayed threat score;
- and
- suspend, based on the aggregate threat score, user activity corresponding to one or more of:
- a particular computer user;
- a particular computer application;
- and
- a particular activity.
Dependencies are inferred from the claim text.