Method for controlling risk in a computer security artificial neural network expert system

A data processing system for providing real-time response to security threats, the data processing system comprising

• a bus;
• a storage device connected to the bus, wherein the storage device contains computer usable code;
• at least one managed device connected to the bus;
• a communications unit connected to the bus;
• and a processing unit connected to the bus, wherein the processing unit executes the computer usable code to receive data collected by monitors of a system to form received data, compare the received data against information in a knowledge base to identify a security threat to a system resource in a form of a system event and an action for mitigating effects of the system event comparing a threat risk of the system event against a risk of the action for mitigating the system event, determining whether a user configured trust component is greater than the risk of the action in response to determining that the threat risk is greater than the risk of the action, and executing the action against the security threat in responsive to determining that the trust component is greater than the risk of the action.

A computer program product for providing real-time response to security threats, the computer program product comprising:

• a computer usable medium having computer usable program code tangibly embodied thereon, the computer usable program code comprising:
• computer usable program code for receiving data collected by monitors of a system to form received data;
• computer usable program code for comparing the received data against information in a knowledge base to identify a security threat to a system resource in a form of a system event and an action for mitigating effects of the system event;
• computer usable program code for determining whether a threat risk of the system event is greater than a risk of the action for mitigating the system event;
• computer usable program code for determining whether a user configured trust component is greater than the risk of the action in response to determining that the threat risk is greater than the risk of the action;
• and
• computer usable program code for executing the action against the security threat in response to determining that the trust component is greater than the risk of the action.