Patent ID: 9338181
Filing Date: 2016-05-10
CPC Classification: H04L

Claim Text:
1. A data processing method comprising: obtaining a plurality of computer network security threat feeds from two or more computer threat detection systems, and in response, updating a threat score that represents a severity of an actual or suspected attack on a particular host computer of a computer network, based upon computer network attack information in the computer network security threat feeds; determining a number of other detectors that have generated alerts for the same actual or suspected attack on the particular host, and in response, updating the threat score based upon the number; obtaining one or more attacker data values relating to an attacker involved in the same actual or suspected attack on the particular host, and in response, updating the threat score based upon the attacker data values; determining whether a universal resource locator (URL), network address, or hash value associated with the actual or suspected attack have been previously processed, and updating the threat score based upon whether the URL, network address, or hash value have been previously processed; determining all of a user posture, a machine posture, and an attacker posture, wherein the user posture includes at least a title or position in an organization of a user associated with the particular host, wherein the machine posture is based at least in part upon a number of uninstalled patches and whether the particular host is a critical machine, and updating the threat score based upon the user posture, machine posture and attacker posture; obtaining an asset value for the particular host that indicates a worth of the particular host, and updating the threat score based upon the asset value; mapping the updated threat score to one of a plurality of remediation actions, wherein a first remediation action is mapped when the updated threat score is low and a second, different remediation action is mapped when the updated threat score is high; wherein each of the steps of updating the threat score based upon the asset value comprises determining a different individual threat score for that step, the method further comprising determining the updated threat score for the particular host by contributions of the different individual threat scores based upon different specified percentages; based upon the updated threat score and the mapping, selecting and automatically performing one of the plurality of remediation actions on the particular host; wherein the method is performed by one or more special-purpose computing devices.