Threat score determination

A system comprising:

• a processor;
• and
• a memory to store instructions that, when executed by the processor, cause the processor to:
• determine a change in malicious activity for a security object;
• identify a time period of the change;
• determine a first threat score associated with the security object;
• determine a plurality of linked resources in a security database associated with a database record of the security object;
• determine, for each linked resource of the plurality of linked resources, an associated threat score based on the time period, the first threat score, and a relationship between the each linked resource and the security object;
• determine a number of levels between a first linked resource of the plurality of linked resources and a second linked resource of the plurality of linked resources;
• compare the number to a threshold;
• and
• determine an influence of the second linked resource on the associated threat score for each linked resource based on the comparison.

A non-transitory machine-readable storage medium storing instructions that, when executed by a processor of a computing device, cause the processor to:

• determine a change in malicious activity for a security object;
• identify an indicator that provides contextual information for the security object;
• determine a plurality of linked resources that are associated with a database record of the security object;
• determine, for each linked resource of the plurality of linked resources, a relationship between the security object and the each linked resource;
• determine a linked resource threat score for the each linked resource of the plurality of linked resources;
• determine a number of linked resources of the plurality of linked resources that are classified as malicious;
• determine a number of levels between a first linked resource of the plurality of linked resources and a second linked resource of the plurality of linked resources;
• compare the number of levels to a threshold;
• determine an influence of the second linked resource on the first linked resource based on the comparison;
• and
• determine a threat score associated with the security object based on the indicator, the relationship between the security object and the each linked resource of the plurality of linked resources, the number of linked resources of the plurality of linked resources that are classified as malicious, and the influence.