# US 2026/0099596 A1 · Threat detection and mitigation in a networked environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0099596 A1
- Document ID: US20260099596A1
- Status: Published application
- Kind: A1
- Application number: 19/418,169
- Filed: 2025-12-12
- Published: 2026-04-09
- Earliest claimed: 2022-12-12
- Assignees: The Toronto-Dominion Bank
- Applicants: The Toronto-Dominion Bank
- Inventors: Kristina DZEPAROSKA; Rachel L. CLARK
- Web page: https://patentgrep.com/patent/US20260099596A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

One example method includes determining, by a threat detection system and at a first time interval, for an object and based on a first risk score computed for the object, that the object poses a threat to the networked environment. Actual threat data indicating that the object does not pose an actual threat can be received. In response to receiving the actual threat data, a value of a first counter can be computed based on prior incorrect identification of the object as a threat. A counterweight can be identified based on the value of the first counter. A second risk score for the object can be downscaled, using the identified counterweight and at a second time interval, to obtain an updated risk score for the object. Access of the object to system resources can be controlled based on whether the updated risk score satisfies a predetermined risk threshold value.

## Claims

### Claim 1

A computer-implemented method, comprising:
obtaining actual threat data, at a first time interval, indicating that an object that is deployed within a computer environment does not pose an actual threat to the computer environment;
in response to obtaining the actual threat data, computing a value of a first counter by scaling a value of a historical counter;
determining whether a value of a second counter satisfies a first threshold and whether the value of the first counter satisfies a second threshold;
identifying a counterweight based on the value of the first counter and the value of the second counter;
adjusting, using the identified counterweight and at a second time interval, a risk score for the object to obtain an updated risk score for the object; and
controlling access of the object to system resources based on whether the updated risk score satisfies a predetermined risk threshold value.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein prior to obtaining the actual threat data, determining, at the first time interval, based on a first risk score for the object deployed within the computer environment, that the object poses a threat to the computer environment.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein in response to obtaining the actual threat data incrementing the value of the second counter and the value of the historical counter prior to computing the value of the first counter and wherein the identified counterweight includes the value of the second counter and the value of the historical counter.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, comprising:
determining that the value of the second counter satisfies the first threshold and that the value of the first counter satisfies the second threshold; and
in response to determining that the value of the second counter satisfies the first threshold and that the value of the first counter satisfies the second threshold, generating a dynamic value as the counterweight.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, comprising:
determining that the value of the second counter satisfies the first threshold and that the value of the first counter does not satisfy the second threshold; and
in response to determining that the value of the second counter satisfies the first threshold and that the value of the first counter does not satisfy the second threshold, generating a static value as the counterweight.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, comprising:
after identifying the counterweight, resetting the second counter to zero.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein controlling access of the object to the system resources based on whether the updated risk score satisfies the predetermined risk threshold value comprises:
determining that the updated risk score satisfies the predetermined risk threshold value; and
in response to determining that the updated risk score satisfies the predetermined risk threshold value, granting, to the object, access to system resources.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, wherein controlling access of the object to the system resources based on whether the updated risk score satisfies the predetermined risk threshold value comprises:
determining that the updated risk score does not satisfy the predetermined risk threshold value; and
in response to determining that the updated risk score does not satisfy the predetermined risk threshold value, denying the object access to the system resources.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein adjusting, using the identified counterweight, the risk score for the object to obtain the updated risk score for the object comprises:
obtaining, at the second time interval, the risk score for the object; and
scaling the risk score by the identified counterweight to obtain the updated risk score for the object.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, comprising:
analyzing threat events used for calculating the risk score by a trained machine learning model for determining a likelihood that the object poses an actual threat; and
generating actual threat data based on a likelihood that the object poses an actual threat.

### Claim 11

A system comprising:
at least one memory storing instructions; and
at least one hardware processor interoperably coupled with the at least one memory, wherein execution of the instructions by the at least one hardware processor causes performance of operations comprising:
obtaining actual threat data, at a first time interval, indicating that an object that is deployed within a computer environment does not pose an actual threat to the computer environment;
in response to obtaining the actual threat data, computing a value of a first counter by scaling a value of a historical counter;
determining whether a value of a second counter satisfies a first threshold and whether the value of the first counter satisfies a second threshold;
identifying a counterweight based on the value of the first counter and the value of the second counter;
adjusting, using the identified counterweight and at a second time interval, a risk score for the object to obtain an updated risk score for the object; and
controlling access of the object to system resources based on whether the updated risk score satisfies a predetermined risk threshold value.

### Claim 12 (depends on 11)

The system of claim 11, wherein prior to obtaining the actual threat data, determining, at the first time interval, based on a first risk score for the object deployed within the computer environment, that the object poses a threat to the computer environment.

### Claim 13 (depends on 12)

The system of claim 12, wherein in response to obtaining the actual threat data incrementing the value of the second counter and the value of the historical counter prior to computing the value of the first counter and wherein the identified counterweight includes the value of the second counter and the value of the historical counter.

### Claim 14 (depends on 11)

The system of claim 11, the operations comprising:
determining that the value of the second counter satisfies the first threshold and that the value of the first counter satisfies the second threshold; and
in response to determining that the value of the second counter satisfies the first threshold and that the value of the first counter satisfies the second threshold, generating a dynamic value as the counterweight.

### Claim 15 (depends on 11)

The system of claim 11, the operations comprising:
determining that the value of the second counter satisfies the first threshold and that the value of the first counter does not satisfy the second threshold; and
in response to determining that the value of the second counter satisfies the first threshold and that the value of the first counter does not satisfy the second threshold, generating a static value as the counterweight.

### Claim 16 (depends on 11)

The system of claim 11, the operations comprising:
after identifying the counterweight, resetting the second counter to zero.

### Claim 17 (depends on 11)

The system of claim 11, wherein controlling access of the object to the system resources based on whether the updated risk score satisfies the predetermined risk threshold value comprises:
determining that the updated risk score satisfies the predetermined risk threshold value; and
in response to determining that the updated risk score satisfies the predetermined risk threshold value, granting, to the object, access to system resources.

### Claim 18 (depends on 11)

The system of claim 11, wherein adjusting, using the identified counterweight, the risk score for the object to obtain the updated risk score for the object comprises:
obtaining, at the second time interval, the risk score for the object; and
scaling the risk score by the identified counterweight to obtain the updated risk score for the object.

### Claim 19 (depends on 11)

The system of claim 11, the operations comprising:
analyzing threat events used for calculating the risk score by a trained machine learning model for determining a likelihood that the object poses an actual threat; and
generating actual threat data based on a likelihood that the object poses an actual threat.

### Claim 20

A non-transitory, computer-readable medium storing computer-readable instructions, that upon execution by at least one hardware processor, cause performance of operations, comprising:
obtaining actual threat data, at a first time interval, indicating that an object that is deployed within a computer environment does not pose an actual threat to the computer environment;
in response to obtaining the actual threat data, computing a value of a first counter by scaling a value of a historical counter;
determining whether a value of a second counter satisfies a first threshold and whether the value of the first counter satisfies a second threshold;
identifying a counterweight based on the value of the first counter and the value of the second counter;
adjusting, using the identified counterweight and at a second time interval, a risk score for the object to obtain an updated risk score for the object; and
controlling access of the object to system resources based on whether the updated risk score satisfies a predetermined risk threshold value.