Method for controlling risk in a computer security artificial neural network expert system

A computer implemented method for providing real-time responses to security threats comprising:

• receiving data collected by a system monitor, wherein the system monitor is at least one of active daemons or code embedded in the system which detect and report security threat risks to the system resources;
• processing the received data using a security threat response tool that includes:
• a knowledge base that associates security threat events with system resources and further specifies responsive actions that may be undertaken in response to the security threat events, wherein each of the security threat events has an associated security threat risk;
• and
• an inference engine that includes rules for determining whether to initiate a responsive action,
• said processing the received data comprising:
• comparing the received data against information in the knowledge base to identify a security threat event having an associated security threat risk value, wherein the security threat event is associated within the knowledge base with a system resource and an associated responsive action having an associated action risk value;
• comparing the associated security threat risk value to the associated action risk value;
• responsive to the associated security threat risk value being greater than the associated action risk value, determining whether a user configured trust component is greater than the associated action risk value, wherein the user configured trust component specifies a level of trust assigned by the user;
• and
• responsive to determining that the user configured trust component is greater than the associated action risk value, implementing the associated responsive action.