Mechanism to calculate probability of a cyber security incident

A method for calculating the probability of a cyber security incident for a computer within a group of computers comprising:

• a. collecting program file names, checksums, and locations within file systems on one or more computers in the group of computers, where an identity of a program file is determined by a unique file identifier of that program file;
• b. storing in an electronic memory the unique file identifier for each program file, a unique computer identifier for each computer;
• c. storing in an electronic memory for each program file a list of computer identifiers on which the file was found;
• d. determining a plurality of program file bundles by comparing the lists of computer identifiers for program files and bundling program files with similar computer lists;
• e. associating computers with program file bundles by associating any computer that contained any program file in a bundle with that bundle;
• f. accessing security incident history data for each computer such that each unique computer identifier is associated with data indicating a history of security incidents on that computer;
• g. calculating a bundle probability value for a program file bundles by examining computers associated with that bundle and determining a value based on the ratio of those computers that have previously or currently been involved in a security incident to those computers never involved in a security,
• h. calculating a probability of a cyber security incident for the computer by summing probabilities values for one or more program file bundles present on the computer;
• and
• i. reporting or outputting;
• further wherein the function for calculating the bundle probability value for one or more program file bundles is:
• P
• b
• ,
• a
• =
• (
• I
• b
• ,
• a
• C
• b
• ,
• a
• -
• I
• a
• C
• a
• )
• ×
• C
• b
• ,
• a
• C
• _
• B
• ,
• a
• where Pb,a is the probability value for a program file bundle b, at the time of an analysis a, wherein analysis a comprises identifying program file bundles, calculating their bundle probability values, and storing an identity and bundle probability value for one or more of the program file bundles;
• where Ib,a is a number of said computers previously or currently involved in a security incident and that have program file bundle b at the time of analysis a, Cb,a is a total number of computers in the group with program file bundle b at the time of analysis a and Ia is a total number of the computers previously or currently involved in a security incident at the time of analysis a, Ca is a total number of computers in the group at the time of analysis a, and CB,a is an average number of computers per program file bundle, across all program file bundles B at the time of analysis a;
• wherein said organizing the identities of said program files into program file bundles based upon similar distribution across said collection of computers comprises:
• a. dividing the computers into N cells, with one or more computers in each said cell,
• b. obtaining a collection of values {Gnf} that are the number of times a program file f is found within cell n, counting an identified program file no more than once per computer even if it is found multiple times on the computer, and counting said program file once if it was ever installed on a computer, even if it has been removed from the computer,
• c. calculating a distance value dab=F1({Gnfa},{Gnfb}), between possible pairs of program files, symbolized by fa and fb, where the distance value is some function F1 of the collection of {Gnf} values for each program file,
• d. determining program file bundles, where one or more of the program file bundles comprises component program files for which the distance dab between any two is zero or below a threshold.

A method for calculating probability of a security incident for a computer within a group of computers, the method comprising:

• determining presence of unique program files within the group of computers by accessing files on computers and for each unique program file storing a list of computers upon which that file is found;
• determining program file bundles by identifying program files similarly distributed within the group of computers by examining the list of computers stored for each program file;
• calculating a bundle incident probability value for a program file bundle by examining the list of computers upon which said bundle is present and determining which computers were previously or currently involved in a security incident and which computers were never involved in a security incident and determining a ratio of such computers that containing the bundle;
• and
• summing bundle probability values for bundles present on a particular computer to determine a computer security incident value for that computer.