System and method for combining cyber-security threat detections and administrator feedback

A method for combining threat detections:

• detecting, by a computer system, triggering of one or more threat detectors;
• activating, by the computer system, a subset of nodes from a plurality of nodes in a Bayesian network in response to the detection, the activated subset of nodes associated with the triggered threat detectors;
• determining, by the computer system, that feedback associated with the triggered threat detectors is available;
• accumulating, by the computer system, the feedback to a feedback node of the Bayesian network in response to the determination, the feedback node associated with the triggered threat detectors;
• calculating, by the computer system, a probability of malicious action using the Bayesian network to combine probabilities associated with the activated subset of nodes and the feedback node;
• and
• performing, by the computer system, a security action in response to the probability exceeding a threshold value.

A non-transitory computer readable medium storing executable sequences of instructions to combine threat detections, the sequences of instructions comprising instructions to:

• detect triggering of one or more threat detectors;
• activate a subset of nodes from a plurality of nodes in a Bayesian network in response to the detection, the activated subset of nodes associated with the triggered threat detectors;
• determine that feedback associated with the triggered threat detectors is available;
• accumulate the feedback to a feedback node of the Bayesian network in response to the determination, the feedback node associated with the triggered threat detectors;
• calculate a probability of malicious action using the Bayesian network to combine probabilities associated with the activated subset of nodes and the feedback node;
• and
• perform a security action in response to the probability exceeding a threshold value.