# US 10,375,104 B1 · System and method for determining a decayed threat score

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,104 B1
- Document ID: US10375104B1
- Status: Granted
- Kind: B1
- Application number: 15/391,588
- Filed: 2016-12-27
- Granted: 2019-08-06
- Earliest claimed: 2016-12-27
- Assignees: Symantec Corporation
- Applicants: Symantec Corporation
- Inventors: Shang-Chieh Wu; Ranjani Gunupudi; Rehan Jalil
- Web page: https://patentgrep.com/patent/US10375104B1

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to one embodiment, a computer-implemented method performed by a computing device comprising at least one processor, the method comprising determining a threat score for a user action in a computer application and calculating a decayed threat score based on the determined threat score and a damping factor. The threat score being indicative of a risk presented by the user action, the decayed threat score being a modified threat score for the user action, and the damping factor being a constant value used to reduce the determined threat score.

## Claims

### Claim 1

A computerized system comprising:
a computer processor;
a memory configured to store instructions, the instructions when executed by the computer processor are operable to:
determine a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;
calculate a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;
determine an aggregate threat score based on the decayed threat score; and
suspend, based on the aggregate threat score, user activity corresponding to one or more of:
a particular computer user;
a particular computer application; and
a particular activity.

### Claim 2 (depends on 1)

The computerized system of claim 1, wherein the damping factor is a value between 0 and 1.

### Claim 3 (depends on 1)

The computerized system of claim 1, wherein the determined threat score is reduced to a decayed threat score based on a determination that the user action is non-threatening.

### Claim 4 (depends on 1)

The computerized system of claim 1, wherein:
the instructions when executed by the computer processor are further operable to identify a risk level corresponding to the determined threat score, wherein the risk level comprises a range of threat scores; and
the decayed threat score is reduced at a maximum to a minimum value in the range of the corresponding risk level.

### Claim 5

A computer-implemented method performed by a computing device comprising at least one processor, the method comprising:
determining a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;
calculating a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;
determining an aggregate threat score based on the decayed threat score; and
suspending, based on the aggregate threat score, user activity corresponding to one or more of:
a particular computer user;
a particular computer application; and
a particular activity.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein the damping factor is a value between 0 and 1.

### Claim 7 (depends on 5)

The computer-implemented method of claim 5, wherein the determined threat score is reduced to a decayed threat score based on a determination that the user action is non-threatening.

### Claim 8 (depends on 5)

The computer-implemented method of claim 5, further comprising:
identifying a risk level corresponding to the determined threat score, wherein the risk level comprises a range of threat scores; and
wherein the decayed threat score is reduced at a maximum to a minimum value in the range of the corresponding risk level.

### Claim 9

One or more computer-readable non-transitory storage media in one or more computing systems, the media embodying logic that is operable when executed by a computer processor to:
determine a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;
calculate a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;
determine an aggregate threat score based on the decayed threat score; and
suspend, based on the aggregate threat score, user activity corresponding to one or more of:
a particular computer user;
a particular computer application; and
a particular activity.

### Claim 10 (depends on 9)

The media of claim 9, the media embodying logic that is further operable when executed by the computer processor to:
identify a risk level corresponding to the determined threat score, wherein the risk level comprises a range of threat scores; and
wherein the decayed threat score is reduced at a maximum to a minimum value in the range of the corresponding risk level.