US 2026/0099596 A1 · THREAT DETECTION AND MITIGATION IN A NETWORKED ENVIRONMENT

Abstract

One example method includes determining, by a threat detection system and at a first time interval, for an object and based on a first risk score computed for the object, that the object poses a threat to the networked environment. Actual threat data indicating that the object does not pose an actual threat can be received. In response to receiving the actual threat data, a value of a first counter can be computed based on prior incorrect identification of the object as a threat. A counterweight can be identified based on the value of the first counter. A second risk score for the object can be downscaled, using the identified counterweight and at a second time interval, to obtain an updated risk score for the object. Access of the object to system resources can be controlled based on whether the updated risk score satisfies a predetermined risk threshold value.

Claims20

Dependent claims

A computer-implemented method, comprising:

obtaining actual threat data, at a first time interval, indicating that an object that is deployed within a computer environment does not pose an actual threat to the computer environment;
in response to obtaining the actual threat data, computing a value of a first counter by scaling a value of a historical counter;
determining whether a value of a second counter satisfies a first threshold and whether the value of the first counter satisfies a second threshold;
identifying a counterweight based on the value of the first counter and the value of the second counter;
adjusting, using the identified counterweight and at a second time interval, a risk score for the object to obtain an updated risk score for the object;
and
controlling access of the object to system resources based on whether the updated risk score satisfies a predetermined risk threshold value.

4 more elements

A system comprising:

at least one memory storing instructions;
and
at least one hardware processor interoperably coupled with the at least one memory, wherein execution of the instructions by the at least one hardware processor causes performance of operations comprising:
obtaining actual threat data, at a first time interval, indicating that an object that is deployed within a computer environment does not pose an actual threat to the computer environment;
in response to obtaining the actual threat data, computing a value of a first counter by scaling a value of a historical counter;
determining whether a value of a second counter satisfies a first threshold and whether the value of the first counter satisfies a second threshold;
identifying a counterweight based on the value of the first counter and the value of the second counter;
adjusting, using the identified counterweight and at a second time interval, a risk score for the object to obtain an updated risk score for the object;
and
controlling access of the object to system resources based on whether the updated risk score satisfies a predetermined risk threshold value.

7 more elements

Dependencies are inferred from the claim text.

Threat detection and mitigation in a networked environment

Life of this patent

Threat detection and mitigation in a networked environment

Life of this patent

Abstract

Claims20