System and method for evaluating network threats and usage
AssigneePalantir Technologies Inc.
InventorAlexander Visbal
Life of this patent
Estimating the term…
Abstract
Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.
Claims20
A system for detecting computer network threats, the system comprising one or more computer hardware processors that execute specific code instructions to cause the system to at least:
- access a data log comprising activity entries associated with one or more network addresses;
- identify, based at least in part on the data log, one or more activity entries associated with a computing system attempting to access one or more computer networks;
- obtain a reliability factor associated with one or more of the activity entries, wherein the reliability factor is based at least in part on a likelihood that a data source is providing reliable information with respect to at least one of the activity entries;
- determine, based at least in part on the reliability factor, a threat indicator for the computing system, wherein the threat indicator indicates a risk level associated with the computing system;
- and
- initiate, based at least in part on the threat indicator, an action to perform one or more of:
- blocking the computing system from accessing at least one of the computer networks, modifying a heat map of network addresses, and modifying a network address list.
A computer-implemented method comprising:
- accessing a data log comprising activity entries associated with one or more network addresses;
- identifying, based at least in part on the data log, one or more activity entries associated with a computing system attempting to access one or more computer networks;
- obtaining a reliability weighting for a data source providing one or more of the activity entries for the data log, wherein the reliability weighting is based at least in part on a likelihood that the data source is providing reliable information with respect to at least one of the activity entries;
- applying the reliability weighting to the one or more activity entries;
- determining, based at least in part on the reliability weighting applied to the one or more activity entries, a threat indicator for the computing system, wherein the threat indicator indicates a risk level associated with the computing system;
- and
- initiating, based at least in part on the threat indicator, an action to perform one or more of:
- blocking the computing system from accessing at least one of the computer networks, modifying a heat map of network addresses, and modifying a network address list.
A non-transitory computer-readable storage medium storing computer-executable instructions configured to cause one or more computer processors to at least:
- access a data log comprising activity entries associated with one or more network addresses;
- identify, based at least in part on the data log, one or more activity entries associated with a computing system attempting to access one or more computer networks;
- determine an overall reliability factor associated with a set of data sources providing the activity entries based at least in part on a likelihood that the set of data sources is providing reliable information with respect to the activity entries;
- determine, based at least in part on the reliability factor, a threat indicator for the computing system, wherein the threat indicator indicates a risk level associated with the computing system;
- and
- associate, in a network address list, the computing system with the determined threat indicator.
Dependencies are inferred from the claim text.