Systems and methods for autonomous security control to prevent file execution based on incident classification crowdsourcing

A system for autonomous security control to prevent a security event based on incident classification crowdsourcing, comprising:

• memory storing computer program instructions;
• and
• one or more processors configured to execute the computer program instructions to:
• receive from a plurality of computing devices, incident classification data corresponding to at least one security event, the incident classification data comprising at least one event identifier and at least one associated risk classification;
• wherein a given event identifier is associated with a given security event;
• aggregate the received incident classification data;
• generate a risk profile for each security event based on a number of independent risk classifications within the aggregated incident classification data indicating the security event as malicious;
• assign a risk score to each security event, wherein the risk score is dynamically adjusted based on at least one of:
• a volume of independent sources classifying the security event as malicious, respective reputations of the sources providing classifications, or a temporal distribution of classifications over time;
• determine whether the risk score for a given security event exceeds a predefined execution prevention threshold;
• upon determining that the risk score exceeds the threshold for the given security event, generate an event prevention policy specifying that the given security event should be blocked from execution across the computing devices in a participating group of computing devices;
• transmit the execution prevention policy to the group of computing devices;
• and
• prevent execution of the given security event on the computing devices subscribed to the security control system.

One or more non-transitory computer storage media having computer executable instructions stored thereon which, when executed by one or more processors, cause the processors to execute a method for autonomous security control to prevent file execution based on incident classification crowdsourcing, comprising:

• receiving, from multiple computing devices across different organizations, incident classification data corresponding to security events, the incident classification data comprising file identifiers and associated risk classifications;
• wherein a given file identifier identifies a given file;
• aggregating the received incident classification data;
• generating a risk profile for each identified file based on a number of independent risk classifications within the aggregated incident classification data indicating the file as malicious;
• assigning a risk score to each file, wherein the risk score is dynamically adjusted based on at least one of:
• a volume of independent organizations classifying the file as malicious, respective reputations of the organizations providing classifications, or a temporal distribution of classifications over time;
• determining whether the risk score for a given file exceeds a predefined execution prevention threshold;
• upon determining that the risk score exceeds the threshold for the given file, generating an execution prevention policy specifying that the given file should be blocked from execution across the computing devices in a participating organization;
• transmitting the execution prevention policy to the computing devices;
• wherein the execution prevention policy comprises different levels of restriction based on the risk score, the levels comprising at least one of warning messages, quarantine actions, or complete execution blocks;
• and
• preventing execution of the given file on the computing devices subscribed to the security control system.