System and method for mitigating cyber security threats by devices using risk factors

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• determining a plurality of risk factors for a device based on a plurality of risk behaviors indicated by network activity and information of the device, wherein the plurality of risk behaviors includes observed risk behaviors and assumed risk behaviors, wherein the observed risk behaviors are indicated by data related to network activity by the device, wherein the assumed risk behaviors are extrapolated based on known contextual information related to the device, wherein the observed risk behaviors are determined based on data related to at least one of:
• configuration of the device, network activity by the device, geographic movement of the device, signal strength of the device, and a protocol used by the device;
• determining a risk score for the device based on the plurality of risk factors and a plurality of weights, wherein each of the plurality of weights is applied to one of the plurality of risk factors;
• and
• performing at least one mitigation action based on the risk score.

A system for mitigating cyber security threats by devices using risk factors, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• determine a plurality of risk factors for a device based on a plurality of risk behaviors indicated by network activity and information of the device, wherein the plurality of risk behaviors includes observed risk behaviors and assumed risk behaviors, wherein the observed risk behaviors are indicated by data related to network activity by the device, wherein the assumed risk behaviors are extrapolated based on known contextual information related to the device, wherein the observed risk behaviors are determined based on data related to at least one of:
• configuration of the device, network activity by the device, geographic movement of the device, signal strength of the device, and a protocol used by the device;
• determine a risk score for the device based on the plurality of risk factors and a plurality of weights, wherein each of the plurality of weights is applied to one of the plurality of risk factors;
• and
• perform at least one mitigation action based on the risk score.