System And Method For Threat Risk Scoring Of Security Threats
AssigneeCyphort Inc.
InventorsFengmin Gong, Frank Jas, Druce MacFarlane
Life of this patent
Estimating the term…
Abstract
A system configured to generate a risk score for a threat activity including a digital device. The digital device configured to extract one or more threat events on a network based on metadata for one or more targeted digital devices on the network. Further, the digital device is configured to detect one or more incidents based on a correlation between at least a first threat event of the one or more threat events and a second threat event of the one or more threat events. And, the digital device is configured to generate a risk score for each of said one or more incidents.
Claims20
A system configured to generate a risk score for a threat activity comprising:
- a digital device configured to:
- extract one or more threat events on a network based on metadata for one or more targeted digital devices on said network;
- detect one or more incidents based on a correlation between at least a first threat event of said one or more threat events and a second threat event of said one or more threat events;
- and
- generate a risk score for each of said one or more incidents.
A system configured to detect a threat activity comprising:
- memory;
- one or more processors;
- and
- one or more modules stored in memory and configured for execution by the one or more processors, the modules comprising:
- a collection module configured to:
- extract one or more threat events on a network from metadata received from one or more targeted digital devices on said network;
- detect one or more incidents based on a correlation between at least a first threat event of said one or more threat events and a second threat event of said one or more threat events;
- and
- generate a risk score for each of said one or more incidents.
A method for detecting incidents comprising:
- at a server including one or more processing units and memory:
- extracting one or more threat events on a network from metadata received from one or more targeted digital devices on said network;
- detecting one or more incidents based on a correlation between at least a first threat event of said one or more threat events and a second threat event of said one or more threat events;
- and
- generating a risk score for each of said one or more incidents.
Dependencies are inferred from the claim text.