Patent Description:
A network security incident in an organization is often similar to network security incidents that have occurred in other organizations. Information regarding the network security incidents at other organizations can be used to enable detection and prevention of malicious network activity. Such information may be gathered from various sources with varying degrees of credibility. For example, some information may be received from a trusted network security source that publishes indicators of network threats. Other information may be gathered from anonymous user posts on public network security forums. The volume of information to be analyzed can create a backlog that delays detecting and preventing malicious network activity.

<CIT> discusses a collective threat intelligence gathering system. <CIT> discloses a security platform that processes event data and assigns an anomaly score and a threat indicator score.

In a particular implementation, a device includes a communication interface and a processor. The communication interface is configured to receive a network threat report. The processor is configured to extract an indicator from the network threat report. The indicator is reported to be associated with a network threat. The processor is also configured to determine, based on the indicator, a confidence score indicating a likelihood that the indicator is associated with malicious activity. The processor is further configured to determine, based on the indicator, an impact score indicating a potential severity of the malicious activity. The processor is further configured to identify, based on the indicator, the confidence score, and the impact score, an action to be performed. The action includes blocking network traffic corresponding to the indicator or monitoring network traffic corresponding to the indicator. The processor is also configured to initiate performance of the action.

In another particular implementation, a method includes receiving a network threat report at a device. The method also includes extracting, at the device, an indicator from the network threat report. The indicator is reported to be associated with a network threat. The method further includes determining, based on the indicator, a confidence score indicating a likelihood that the indicator is associated with malicious activity. The method also includes determining, based on the indicator, an impact score indicating a potential severity of the malicious activity. The method further includes identifying, based on the indicator, the confidence score, and the impact score, an action to be i performed. The action includes blocking network traffic corresponding to the indicator or monitoring network traffic corresponding to the indicator. The method also includes initiating performance of the action.

In another particular implementation, a computer-readable storage device stores instructions that, when executed by a processor, cause the processor to perform operations ) including receiving a network threat report. The operations also include extracting an indicator from the network threat report. The indicator is reported to be associated with a network threat. The operations further include determining, based on the indicator, a confidence score indicating a likelihood that the indicator is associated with malicious activity. The operations also include determining, based on the indicator, an impact score indicating a potential severity of the malicious activity. The operations further include identifying, based on the indicator, the confidence score, and the impact score, an action to be performed. The action includes blocking network traffic corresponding to the indicator or monitoring network traffic corresponding to the indicator. The operations also include initiating performance of the action.

) The features, functions, and advantages described herein can be achieved independently in various implementations or may be combined in yet other implementations, further details of which can be found with reference to the following description and drawings.

Implementations described herein are directed to network threat indicator extraction and response. For example, a threat report analyzer receives a network threat report from a first source. The network threat report includes one or more indicators that are reported to be associated with network threats. As an example, an indicator can include an internet protocol (IP) address that is reported to be associated with a network threat. The threat report analyzer determines properties associated with the indicator. For example, the threat report analyzer extracts at least one property from the network threat report. To illustrate, the network threat report can include an attribution identifier that indicates a reported perpetrator of the network threat. As another example, the threat report analyzer determines at least one property based on data from a second source (e.g., a trusted source). For example, the threat report analyzer sends a request to a device associated with the second source. The request includes the indicator. The threat report analyzer receives data associated with the indicator from the device. For example, the data indicates whether the second source also reports that the indicator is associated with a network threat.

The threat report analyzer determines a confidence score and an impact score based on the properties associated with the indicator. The confidence score indicates a likelihood of the indicator being associated with malicious activity. For example, the confidence score is higher if the second source also reports that the indicator is associated with a network threat. The impact score indicates a potential severity of the malicious activity. For example, the impact score is higher if the attribution identifier attributes the indicator to a party that is known to perpetrate harmful and/or widespread network threats.

The threat report analyzer determines, based on the confidence score and the impact score, a position of the indicator in a response queue and adds the indicator at the position in the response queue. The response queue indicates an order in which indicators are to be processed for corresponding actions, if any, to be taken. The position of the indicator in the response queue indicates a priority of the indicator. An indicator with a higher priority is processed earlier. In some examples, the response queue has a particular capacity. When the response queue is filled to capacity, the threat report analyzer may remove a lower priority indicator from the response queue prior to adding a higher priority indicator to the response queue.

The threat report analyzer retrieves the indicator from the response queue in response to determining that the indicator is a next indicator to be processed in the response queue. The threat report analyzer identifies, based on the confidence score and the impact score, an action to be performed. For example, the action includes monitoring network traffic corresponding to the indicator or blocking network traffic corresponding to the indicator. In a particular example, the threat report analyzer identifies the action to be performed in response to retrieving the indicator from the response queue. In another example, the threat report analyzer identifies the action to be performed independently of adding the indicator to the response queue. The threat report analyzer initiates performance of the action. In a particular example, the action is performed independently of receiving user input indicating that the action is to be performed.

Indicators with a higher likelihood of being associated with malicious activity and/or indicators that indicate higher potential severity of malicious activity are processed earlier. Faster searching of (or access to) higher priority indicators improves computer functionality by enabling the threat report analyzer to prevent or reduce an impact of the corresponding malicious activity. Prioritizing the indicators based on the confidence score and the impact score increases an accuracy of the priority calculation as compared to a subjective determination of indicator priority. The threat report analyzer enables filtering of internet traffic that can be customized based on rules associated with computing the confidence score and the impact score for particular properties of indicators. Performing the action automatically (e.g., without receiving user input indicating that the action is to be performed) reduces (e.g., eliminates) a mean time to respond to malicious activity.

<FIG> is a block diagram of a system <NUM> that is operable to perform network threat indicator extraction and response. The system <NUM> includes a first device <NUM> that is coupled via a network <NUM> to one or more devices. For example, the first device <NUM> is coupled via the network <NUM> to a second device <NUM>, a third device <NUM>, a fourth device <NUM>, one or more additional devices, or a combination thereof. The first device <NUM> corresponds to, for example, a computer, a server, a distributed system, or a combination thereof. The network <NUM> includes a wired network, a wireless network, or both. One or more of the second device <NUM>, the third device <NUM>, or the fourth device <NUM> include, for example, a web server, a database, a computer, a server, a distributed system, a mobile device, a communication device, a desktop computer, a laptop, a tablet computer, or a combination thereof. The first device <NUM> is coupled via a communication interface <NUM> to the network <NUM>.

It should be noted that in the following description, various functions performed by the system <NUM> of <FIG> are described as being performed by certain components or modules. However, this division of components and modules is for illustration only. In an alternate aspect, a function described herein as performed by a particular component or module may be divided amongst multiple components or modules. Moreover, in an alternate aspect, two or more components or modules of <FIG> may be integrated into a single component or module. Each component or module illustrated in <FIG> can be implemented using hardware (e.g., a field-programmable gate array (FPGA) device, an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a controller, etc.), software (e.g., instructions executable by a processor), or any combination thereof.

The first device <NUM> is coupled via an output interface <NUM> to a display device <NUM>. The first device <NUM> includes a memory <NUM>. The first device <NUM> includes an input interface <NUM>. The input interface <NUM> is coupled to one or more input devices, such as a touchscreen, a mouse, a keyboard, a microphone, a camera, or a combination thereof. The first device <NUM> includes a threat report analyzer <NUM> (e.g., a processor). The threat report analyzer <NUM> is configured to analyze a network threat report <NUM>.

During operation, the first device <NUM> receives the network threat report <NUM>, via the communication interface <NUM>, from the second device <NUM>. In a particular aspect, the second device <NUM> is associated with a first source, such as a particular website, a particular organization, a third-party, or a combination thereof. As an example, the network threat report <NUM> could include user posts on a web forum that discuss network security issues. As another example, the network threat report <NUM> could include reports of network threats published by a network security organization. The threat report analyzer <NUM> can receive reports from many different sources concurrently. In a particular implementation, the threat report analyzer <NUM> uses web-scraping techniques to generate network threat reports from various sources. For example, the threat report analyzer <NUM> generates the network threat report <NUM> by extracting data from web pages hosted by the second device <NUM>. In a particular implementation, the threat report analyzer <NUM> subscribes to receive network threat reports from various sources. For example, the threat report analyzer <NUM> subscribes to a service offered by the first source and receives the network threat report <NUM> from the second device <NUM> as part of the subscription. In a particular aspect, the first source includes a third-party (e.g., a business entity, a security expert, or both) that monitors network threats and publishes network threat reports (e.g., the network threat report <NUM>). The network threats are caused by one or more perpetrators. The first device <NUM> receives the network threat reports (e.g., the network threat report <NUM>) generated by the first source from the second device <NUM>.

The threat report analyzer <NUM> extracts one or more indicators from the network threat report <NUM>. For example, the threat report analyzer <NUM> extracts an indicator <NUM> from the network threat report <NUM>. In a particular aspect, the network threat report <NUM> includes text (e.g., natural or unstructured language). In this aspect, the threat report analyzer <NUM> extracts the indicator <NUM> from the network threat report <NUM> by performing a keyword search, natural language processing, etc. For example, the threat report analyzer <NUM> detects a particular keyword (or phrase) in the network threat report <NUM> by performing a keyword search (or natural language processing) and extracts the indicator <NUM> from the network threat report <NUM> based on detecting the particular keyword (or phrase). In a particular aspect, the network threat report <NUM> is formatted or structured (e.g., includes key-value pairs). In this aspect, the threat report analyzer <NUM> extracts the indicator <NUM> from the network threat report <NUM> by parsing the network threat report <NUM> based on the corresponding format or structure. For example, the threat report analyzer <NUM> extracts a particular element (e.g., a value of a particular key-value pair) from the network threat report <NUM> as the indicator <NUM>. The network threat report <NUM> indicates that the indicator <NUM> is reported to be associated with a network threat. For example, an organization reports that the indicator <NUM> is associated with a network threat. As another example, a user posts the indicator <NUM> in a network security forum. In a particular implementation, the indicator <NUM> corresponds to an indicator of compromise (IOC). An IOC includes an artifact (i.e., an observable feature) that indicates a network threat (e.g., a computer intrusion). The indicator <NUM> includes, but is not limited to, an internet protocol (IP) address, a virus signature, an e-mail address, an e-mail subject, a domain name, a uniform resource identifier (URI), a uniform resource locator (URL), a filename, a message digest algorithm <NUM> (MD5) hash, a file path, or a combination thereof.

The threat report analyzer <NUM> determines one or more properties <NUM> associated with the indicator <NUM>. The properties <NUM> include, for example, an indicator type, a threat type, an attack type, a registration date, a first seen date, a last seen date, a first reported date, a last reported date, a report source, a particular keyword, a kill chain phase, an attribution identifier, an attribution confidence, a report volume, a false positive rate, another property, or a combination thereof, as further described with reference to <FIG>.

In a particular aspect, the threat report analyzer <NUM> extracts at least some of the properties <NUM> from the network threat report <NUM>. For example, the threat report analyzer <NUM> extracts the indicator type, the threat type, the attack type, the registration date, the first seen date, the last seen date, the first reported date, the last reported date, the report source, the particular keyword, the kill chain phase, the attribution identifier, the attribution confidence, or a combination thereof, from the network threat report <NUM>.

In a particular aspect, the threat report analyzer <NUM> receives additional data associated with the indicator <NUM>. For example, the threat report analyzer <NUM> sends a first request <NUM> to the third device <NUM>. In a particular aspect, the third device <NUM> is associated with a second source (e.g., a first trusted source). The first request <NUM> includes the indicator <NUM>. The third device <NUM> sends first data <NUM> to the first device <NUM> responsive to the first request <NUM>. The first data <NUM> is associated with the indicator <NUM>. For example, the first data <NUM> indicates whether the second source has reports of a network threat associated with the indicator <NUM>.

In a particular aspect, the threat report analyzer <NUM> receives additional data associated with the indicator <NUM> from multiple additional sources. For example, the threat report analyzer <NUM> sends a second request <NUM> to the fourth device <NUM>. In a particular aspect, the fourth device <NUM> is associated with a third source (e.g., a second trusted source). The fourth device <NUM>, in response to receiving the second request <NUM> including the indicator <NUM>, sends second data <NUM> to the first device <NUM>. The second data <NUM> is associated with the indicator <NUM>. For example, the first data <NUM> indicates whether the third source has reports of a network threat associated with the indicator <NUM>.

In a particular aspect, the threat report analyzer <NUM> has access to additional data associated with the indicator <NUM>. For example, historical data <NUM> is stored in the memory <NUM>. In a particular aspect, the historical data <NUM> corresponds to logs, such as system logs, network logs, or both. To illustrate, the historical data <NUM> indicates a number of accesses to a domain name indicated by the indicator <NUM>. As another example, lookup data <NUM> (e.g., a table) is stored in the memory <NUM>. The lookup data <NUM> includes, as an example, configuration settings, default values, user input, or a combination thereof. To illustrate, the lookup data <NUM> indicates that a particular keyword is associated with a particular score for calculating the confidence score <NUM>, the impact score <NUM>, or both, as further described with reference to <FIG>.

In a particular aspect, the threat report analyzer <NUM> determines at least some of the properties <NUM> based on the first data <NUM>, the second data <NUM>, the historical data <NUM>, or a combination thereof. For example, the threat report analyzer <NUM> determines a report volume, a false positive rate, or both, as further described with reference to <FIG>.

The threat report analyzer <NUM> determines a confidence score <NUM> based on the properties <NUM>, as further described with reference to <FIG>. The confidence score <NUM> indicates a likelihood that the indicator <NUM> is associated with malicious activity. For example, the confidence score <NUM> indicates a higher likelihood that the indicator <NUM> is associated with malicious activity if the indicator <NUM> is reported as associated with a network threat by a more trusted source (e.g., an organization that publishes network threat indicators) as compared to an anonymous source (e.g., an anonymous user on a public forum). To illustrate, the anonymous source could be incorrectly (or maliciously) reporting the indicator <NUM> as associated with a network threat. If the more trusted source is reporting the indicator <NUM> as associated with a network threat, the likelihood is higher that the indicator <NUM> is associated with potential malicious activity.

The threat report analyzer <NUM> determines an impact score <NUM> based on the properties <NUM>, as further described with reference to <FIG>. The impact score <NUM> indicates a potential severity of malicious activity associated with the indicator <NUM>. For example, if the effect of the malicious activity associated with the indicator <NUM> is likely to be more damaging, more widespread, or both, the malicious activity has a higher potential severity. A particular kill chain phase of a kill chain, such as a cyber kill chain® (a registered trademark of Lockheed Martin Corp. , Maryland), is associated with the indicator <NUM>. The particular kill chain phase indicates a likely effect of the malicious activity associated with the indicator <NUM>. For example, malicious activity for the indicator <NUM> associated with a first kill chain phase (e.g., reconnaissance) is likely to have a less damaging and/or less widespread effect as compared to malicious activity for the indicator <NUM> associated with a second kill chain phase (e.g., command and control). The impact score <NUM> indicates a higher severity for the second kill chain phase (e.g., command and control) as compared to the first kill chain phase (e.g., reconnaissance).

The threat report analyzer <NUM> determines an overall score <NUM> of the indicator <NUM> based on the confidence score <NUM>, the impact score <NUM>, or both. In a particular example, the overall score <NUM> corresponds to a weighted sum of the confidence score <NUM> and the impact score <NUM>. The overall score <NUM> indicates a first priority of the indicator <NUM>.

The threat report analyzer <NUM> is configured to add indicators to a response queue <NUM> in order of their overall scores. For example, the threat report analyzer <NUM> determines a position <NUM> in the response queue <NUM> based on the overall score <NUM>. The threat report analyzer <NUM> adds the indicator <NUM> at the position <NUM> in the response queue <NUM>. In a particular aspect, the position <NUM> in the response queue <NUM> is empty and the threat report analyzer <NUM> adds the indicator <NUM> at the position <NUM>. In an alternate aspect, the position <NUM> in the response queue <NUM> is occupied by another indicator that has a lower overall score than the overall score of the indicator <NUM>. The threat report analyzer <NUM> updates (e.g., increments by <NUM>) positions of indicators at and subsequent to the position <NUM> and adds the indicator <NUM> at the position <NUM>. In a particular example, the response queue <NUM> has a particular capacity. The threat report analyzer <NUM>, in response to determining that the response queue <NUM> is filled to capacity, removes a second indicator from (e.g., the last position of) the response queue <NUM> prior to adding the indicator <NUM> to the response queue <NUM> at the position <NUM>. Removing lower priority indicators enables the response queue <NUM> to have a lower memory footprint compared to storing all indicators in the memory <NUM>.

The threat report analyzer <NUM> generates a graphical user interface (GUI) <NUM>. The GUI <NUM> indicates one or more of a portion of the network threat report <NUM>, the indicator <NUM>, one or more of the properties <NUM>, the confidence score <NUM>, the impact score <NUM>, the overall score <NUM>, the position <NUM>, or the response queue <NUM>. In a particular implementation, the threat report analyzer <NUM> generates the GUI <NUM> in response to adding the indicator <NUM> to the response queue <NUM>. In another implementation, the threat report analyzer <NUM> generates the GUI <NUM> in response to receiving a user input <NUM> from a first user <NUM> (e.g., a network administrator) requesting information regarding updates to the response queue <NUM>. In a particular aspect, the first user <NUM> provides the user input <NUM> indicating an update to data associated with the indicator <NUM> and the threat report analyzer <NUM> updates the data. For example, the user input <NUM> indicates at least one of an updated position, an updated property, an updated confidence score <NUM>, an updated impact score <NUM>, or an updated overall score <NUM>. The threat report analyzer <NUM>, in response to receiving the user input <NUM>, updates the position <NUM>, the properties <NUM>, the confidence score <NUM>, the impact score <NUM>, and the overall score <NUM> to indicate the updated position, the updated property, the updated confidence score <NUM>, the updated impact score <NUM>, and the updated overall score <NUM>, respectively. In a particular aspect, the threat report analyzer <NUM> removes the indicator <NUM> from the response queue <NUM> in response to receiving the user input <NUM> indicating that the indicator <NUM> is to be removed from the response queue <NUM>.

The threat report analyzer <NUM> is configured to process the response queue <NUM>. For example, the threat report analyzer <NUM> determines that the indicator <NUM> is the next indicator to be processed in response to determining that a next pointer indicates the position <NUM>. The threat report analyzer <NUM>, in response to determining that the indicator <NUM> is the next indicator to be processed, retrieves the indicator <NUM> from the response queue <NUM> and updates the next pointer to indicate a position subsequent to the position <NUM> in the response queue <NUM>.

The threat report analyzer <NUM> identifies, based on the indicator <NUM>, an action <NUM> to be performed. For example, the threat report analyzer <NUM> identifies the action <NUM> based on the indicator <NUM>, the confidence score <NUM>, the impact score <NUM>, or a combination thereof, as further described with reference to <FIG>. The action <NUM> can include, for example, blocking network traffic associated with the indicator <NUM>, monitoring network traffic associated with the indicator <NUM>, or both. For example, the action <NUM> can include blocking network traffic from a first subdomain of a domain indicated by the indicator <NUM>, monitoring network traffic from a second subdomain of the domain, or both. As another example, the action <NUM> can include blocking a first type of traffic from an IP address indicated by the indicator <NUM>, monitoring a second type of traffic from the IP address, or both.

In a particular aspect, the threat report analyzer <NUM> initiates performance of the action <NUM> in response to identifying the action <NUM>. In a particular implementation, the threat report analyzer <NUM> performs the action <NUM> in response to identifying the action <NUM>. In an alternate implementation, initiating the performance of the action <NUM> includes scheduling a performance of the action <NUM>. For example, the threat report analyzer <NUM> schedules the performance of the action <NUM> by adding the action <NUM> to the action queue <NUM>. The threat report analyzer <NUM> generates (or updates) the GUI <NUM>. The GUI <NUM> indicates one or more of a portion of the network threat report <NUM>, the indicator <NUM>, one or more of the properties <NUM>, the confidence score <NUM>, the impact score <NUM>, the overall score <NUM>, the action <NUM>, or the action queue <NUM>. In a particular implementation, the threat report analyzer <NUM> generates (or updates) the GUI <NUM> in response to adding the action <NUM> to the action queue <NUM>. In another implementation, the threat report analyzer <NUM> generates (or updates) the GUI <NUM> in response to receiving the user input <NUM> from the first user <NUM> requesting information regarding actions added to the action queue <NUM>.

In a particular implementation, the threat report analyzer <NUM> is configured to perform actions in the action queue <NUM> in response to receiving explicit user requests to perform corresponding actions. For example, the performance of the action <NUM> is initiated in response to receiving the user input <NUM> indicating that the action <NUM> is to be performed. To illustrate, the threat report analyzer <NUM> performs the action <NUM> in response to receiving the user input <NUM> indicating that the action <NUM> is to be performed. In a particular example, the first user <NUM> reviews the action <NUM> added to the action queue <NUM> and provides the user input <NUM> indicating approval of the action <NUM>. Alternatively, the threat report analyzer <NUM> refrains from performing the action <NUM> in response to determining that the user input <NUM> (indicating that the action <NUM> is to be performed) has not been received or that the user input <NUM> indicates that the action <NUM> is not to be performed. The threat report analyzer <NUM>, in response to receiving the user input <NUM> indicating that the action <NUM> is not to be performed, removes the action <NUM> from the action queue <NUM>.

In a particular implementation, the threat report analyzer <NUM> is configured to perform actions in the action queue <NUM> unless an explicit user cancelation is received in a timely manner. For example, the threat report analyzer <NUM> performs the action <NUM> in response to determining that the user input <NUM> indicating that the action <NUM> is not to be performed has not been received. To illustrate, the threat report analyzer <NUM> performs the action <NUM> unless the first user <NUM> provides the user input <NUM> indicating that performance of the action <NUM> is canceled. If the threat report analyzer <NUM> receives the user input <NUM> indicating that the action <NUM> is not to be performed, the threat report analyzer <NUM> cancels performance of the action <NUM> by removing the action <NUM> from the action queue <NUM>.

In a particular implementation, the memory <NUM> includes a first action queue (e.g., the action queue <NUM>) of actions to be performed in response to an explicit user request and a second action queue (e.g., the action queue <NUM>) of actions to be performed unless an explicit user cancelation is received. The threat report analyzer <NUM> determines, based on the confidence score <NUM>, the impact score <NUM>, the overall score <NUM>, a type of the action <NUM>, or a combination thereof, whether the action <NUM> is to be added to the first action queue (e.g., the action queue <NUM>) or the second action queue (e.g., the action queue <NUM>). In a particular aspect, the threat report analyzer <NUM> determines an action score <NUM> based on the confidence score <NUM>, the impact score <NUM>, the overall score <NUM>, or a combination thereof. The threat report analyzer <NUM> adds the action <NUM> to the second action queue (e.g., the action queue <NUM>) in response to determining that the action score <NUM> is greater than a first threshold or that the action <NUM> is of a first type (e.g., monitor network traffic associated with the indicator <NUM>). Alternatively, the threat report analyzer <NUM> adds the action <NUM> to the first action queue (e.g., the action queue <NUM>) in response to determining that the action score <NUM> is less than or equal to the first threshold and that the action <NUM> is of a second type (e.g., block network traffic associated with the indicator <NUM>).

The threat report analyzer <NUM> performs the action <NUM> from the first action queue (e.g., the action queue <NUM>) in response to receiving the user input <NUM> indicating that the action <NUM> is to be performed. Alternatively, the threat report analyzer <NUM> performs the action <NUM> from the second action queue (e.g., the action queue <NUM>) in response to determining that the user input <NUM> indicating that the action <NUM> is not to be performed has not been received.

The system <NUM> thus enables the indicator <NUM> to be prioritized based on the confidence score <NUM> and the impact score <NUM>. The action <NUM> can be performed without delay for prior user approval when the action score <NUM> satisfies a threshold (e.g., indicating high confidence or high potential severity of the malicious activity) or when the action <NUM> is of a type (e.g., monitoring traffic) that is likely to cause little or no disruption to regular business activity. Harmful impact from malicious activity can thus be reduced (e.g., prevented) with little or no delay associated with waiting for user approval (e.g., in the middle of the night). Faster searching of (or access to) higher priority indicators improves computer functionality by enabling actions to be performed to prevent or reduce an impact of the corresponding malicious activity. Removing lower priority indicators enables the response queue <NUM> to have a lower memory footprint compared to storing all indicators in the memory <NUM>.

Referring to <FIG>, a table is shown and generally designated <NUM>. A first column of the table <NUM> includes examples of the properties <NUM>. A second column of the table <NUM> includes property values <NUM> as illustrative values of the examples of the properties <NUM> indicated in the first column. A third column of the table <NUM> includes examples of confidence/impact/action values <NUM> indicating whether the examples of the properties <NUM> indicated in the first column are used to determine the confidence score <NUM>, the impact score <NUM>, both, or the action <NUM>. It should be understood that the properties <NUM> can include fewer, additional, or different properties than illustrated in the table <NUM>. In some implementations, a particular property of the properties <NUM> can be used to determine the confidence score <NUM>, the impact score <NUM>, both, or the action <NUM>, differently than illustrated in the table <NUM>.

The properties <NUM> include a first seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), a last seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), a report volume <NUM> (e.g., <NUM>), a kill chain phase <NUM> (e.g., command and control (C2)), an attack type <NUM> (e.g., malware), a threat type <NUM> (e.g., malicious IP), one or more description keywords <NUM> (e.g., "scanning"), one or more keyword tags <NUM> (e.g., "exfil"), an attribution identifier <NUM> (e.g., Fluffy Bunny), an attribution confidence <NUM> (e.g., high), a source count <NUM> (e.g., <NUM>), a source reputation score <NUM> (e.g., high), additional sources data <NUM> (e.g., <NUM>/<NUM>), first reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), last reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), one or more manually applied actions <NUM> (e.g., Block - Proxy), an indicator type <NUM> (e.g., IPv4 Address), an indicator creation date <NUM> (e.g., <NUM>/<NUM>/<NUM>), internal hits <NUM> (e.g., <NUM>), last internal hit date <NUM> (e.g., <NUM>/<NUM>/<NUM>), targeted <NUM> (e.g., Yes), a registration date <NUM> (e.g., <NUM>/<NUM>/<NUM>), a false positive rate <NUM> (e.g., <NUM>%), an additional property, or a combination thereof.

In a particular example, the threat report analyzer <NUM> of <FIG> extracts the first seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the last seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the report volume <NUM> (e.g., <NUM>), the kill chain phase <NUM> (e.g., C2), the attack type <NUM> (e.g., malware), the threat type <NUM> (e.g., malicious IP), the description keywords <NUM> (e.g., "scanning"), the keyword tags <NUM> (e.g., "exfil"), the attribution identifier <NUM> (e.g., Fluffy Bunny), the attribution confidence <NUM> (e.g., high), the source count <NUM> (e.g., <NUM>), the source reputation score <NUM> (e.g., high), the first reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the last reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the indicator type <NUM> (e.g., IPv4 Address), the targeted <NUM> (e.g., Yes), the registration date <NUM> (e.g., <NUM>/<NUM>/<NUM>), or a combination thereof, from the network threat report <NUM>. In a particular example, the threat report analyzer <NUM> determines, based on the network threat report <NUM>, the historical data <NUM>, the first data <NUM>, the second data <NUM>, or a combination thereof, the additional sources data <NUM> (e.g., <NUM>/<NUM>), the manually applied actions <NUM> (e.g., Block - Proxy), the indicator creation date <NUM> (e.g., <NUM>/<NUM>/<NUM>), the internal hits <NUM> (e.g., <NUM>), the last internal hit date <NUM> (e.g., <NUM>/<NUM>/<NUM>), the false positive rate <NUM> (e.g., <NUM>%), or a combination thereof, as described herein.

The threat report analyzer <NUM> can determine the confidence score <NUM> based on the first seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the last seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the report volume <NUM> (e.g., <NUM>), the description keywords <NUM> (e.g., "scanning"), the keyword tags <NUM> (e.g., "exfil"), the attribution confidence <NUM> (e.g., high), the source count <NUM> (e.g., <NUM>), the source reputation score <NUM> (e.g., high), the additional sources data <NUM> (e.g., <NUM>/<NUM>), the first reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the last reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>), the manually applied actions <NUM> (e.g., Block - Proxy), the indicator creation date <NUM> (e.g., <NUM>/<NUM>/<NUM>), the registration date <NUM> (e.g., <NUM>/<NUM>/<NUM>), the false positive rate <NUM> (e.g., <NUM>%), or a combination thereof, as described herein. In a particular aspect, the confidence score <NUM> corresponds to a weighted sum of scores of various properties of the properties <NUM>. For example, the threat report analyzer <NUM> assigns a first weight to the first seen date <NUM>, a second weight to the last seen date <NUM>, a first score to the first seen date <NUM> based on the value (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>) of the first seen date <NUM>, a second score to the last seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>) based on the value of the last seen date <NUM>, and determines the confidence score <NUM> based on a weighted sum of the first score and the second score (e.g., the confidence score <NUM> = first weight * first score + second weight * second score).

The threat report analyzer <NUM> can determine the impact score <NUM> based on the report volume <NUM> (e.g., <NUM>), the kill chain phase <NUM> (e.g., C2), the attack type <NUM> (e.g., malware), the threat type <NUM> (e.g., malicious IP), the description keywords <NUM> (e.g., "scanning"), the keyword tags <NUM> (e.g., "exfil"), the attribution identifier <NUM> (e.g., Fluffy Bunny), the additional sources data <NUM> (e.g., <NUM>/<NUM>), the indicator type <NUM> (e.g., IPv4 address), the targeted <NUM> (e.g., Yes), or a combination thereof, as described herein. In a particular aspect, the impact score <NUM> corresponds to a weighted sum of scores of various properties of the properties <NUM>.

The first seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>) indicates a date (e.g., a timestamp) at which a report indicates that the indicator <NUM> was first seen (or detected). For example, the network threat report <NUM> is based on a plurality of reports and a first report (e.g., a user post on a public forum) having an earliest seen date among the plurality of reports indicates that the indicator <NUM> was detected at the first seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>). In a particular example, the confidence score <NUM> is lower for the first seen date <NUM> that is prior to a threshold first seen date. For example, if the indicator <NUM> was first seen two years ago, the indicator <NUM> is less likely to be associated with potential malicious activity.

The last seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>) indicates a date (e.g., a timestamp) at which a report indicates that the indicator <NUM> was last seen (or detected). For example, a second report (e.g., a network security publication) having a most recent seen date among the plurality of reports indicates that the indicator <NUM> was detected at the last seen date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>). In a particular example, the confidence score <NUM> is lower for the last seen date <NUM> that is prior to a threshold last seen date. For example, if the indicator <NUM> was last seen a year ago, the indicator <NUM> is less likely to be associated with potential malicious activity.

The registration date <NUM> (e.g., <NUM>/<NUM>/<NUM>) indicates a date (e.g., a timestamp) at which a report indicates that the indicator <NUM> was registered with a registration authority. For example, the network threat report <NUM> is based on a report that indicates that the indicator <NUM> (e.g., a domain name) was registered on the registration date <NUM> (e.g., <NUM>/<NUM>/<NUM>) with a registration authority (e.g., a domain name registrar). In a particular example, the confidence score <NUM> is lower for the registration date <NUM> that is prior to a threshold registration date. For example, if the indicator <NUM> was registered two years ago, the indicator <NUM> is less likely to be associated with potential malicious activity.

The first reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>) indicates a date (e.g., a timestamp) of an earliest report associated with the indicator <NUM>. For example, a first report (e.g., a user post on a public forum) has the earliest date (e.g., the date of the user post on the public forum) among the plurality of reports associated with the indicator <NUM>. In a particular example, the confidence score <NUM> is lower for the first reported date <NUM> that is prior to a threshold first reported date. For example, if the indicator <NUM> was first reported two years ago, the indicator <NUM> is less likely to be associated with potential malicious activity.

The last reported date <NUM> (e.g., <NUM>/<NUM>/<NUM><NUM>:<NUM>) indicates a date (e.g., a timestamp) of a most recent report associated with the indicator <NUM>. For example, a second report (e.g., a network security publication) having a most recent report date (e.g., the date of the publication) among the plurality of reports associated with the indicator <NUM>. In a particular example, the confidence score <NUM> is lower for the last reported date <NUM> that is prior to a threshold last reported date. For example, if the indicator <NUM> that was last reported a year ago, the indicator <NUM> is less likely to be associated with potential malicious activity.

In a particular aspect, a report (e.g., a user post on a public forum) has a reported date (e.g., the first reported date <NUM> or the last reported date <NUM>) at which the report was published (e.g., a date of the post). The report (e.g., the user post) can indicate a seen date (e.g., the first seen date <NUM> or the last seen date <NUM>) at which the indicator <NUM> was reportedly detected (e.g., the user indicates in the user post that network traffic logs indicate that the indicator <NUM> was detected at the seen date). The seen date is less than or equal to the reported date.

The report volume <NUM> (e.g., <NUM>) indicates a count of reports that indicated that the indicator <NUM> is associated with malicious activity. For example, the network threat report <NUM> is based on a plurality of reports from a plurality of sources. To illustrate, the network threat report <NUM> indicates that a first particular source received a first number of reports (e.g., <NUM>) indicating that the indicator <NUM> is associated with malicious activity and that a second particular source received a second number of reports (e.g., <NUM>) indicating that the indicator <NUM> is associated with malicious activity. The threat report analyzer <NUM> determines the report volume <NUM> (e.g., <NUM>) based on the first number of reports and the second number of reports (e.g., the report volume <NUM> = the first number of reports + the second number of reports). In a particular aspect, the threat report analyzer <NUM> derives the report volume <NUM> (e.g., <NUM>) based on the network threat report <NUM>, the first data <NUM>, the second data <NUM>, or a combination thereof. For example, the threat report analyzer <NUM> determines a first number (e.g., <NUM>) corresponding to the network threat report <NUM> from a first source (e.g., the second device <NUM>) indicating that the indicator <NUM> is associated with malicious activity. The threat report analyzer <NUM> determines a second number (e.g., <NUM>) corresponding to the first data <NUM> indicating that a second source (e.g., the third device <NUM>) received the second number of reports from various sources indicating that the indicator <NUM> is associated with malicious activity. The threat report analyzer <NUM> determines the report volume <NUM> (e.g., <NUM>) based on the first number and the second number (e.g., the report volume <NUM> = the first number + the second number). In a particular example, the confidence score <NUM> is higher for the report volume <NUM> that is higher than a report volume confidence threshold. For example, if many reports indicate that the indicator <NUM> is associated with malicious activity, the indicator <NUM> is more likely to be associated with potential malicious activity. In a particular example, the impact score <NUM> is higher for the report volume <NUM> that is higher than a report volume impact threshold. For example, if many reports indicate that the indicator <NUM> is detected in association with malicious activity, the potential malicious activity associated with indicator <NUM> is likely to have a more severe impact.

The false positive rate <NUM> (e.g., <NUM>%) is based on a number of times the indicator <NUM> is detected (or reported) as associated with non-malicious (or benign) activity and a number of times the indicator <NUM> is detected (or reported) as associated with malicious activity. For example, the network threat report <NUM> indicates that the indicator <NUM> is reportedly associated with malicious activity. The threat report analyzer <NUM> determines, based on the historical data <NUM>, the network threat report <NUM>, or both, that the indicator <NUM> has been reported (or detected) as associated with non-malicious activity a first number of times (e.g., <NUM>) and that the indicator <NUM> has been reported (or detected) as associated with malicious activity a second number of times (e.g., <NUM>). The threat report analyzer <NUM> determines the false positive rate <NUM> (e.g., <NUM>%) based on the first number of times and the second number of times (e.g., the false positive rate <NUM> = the first number of times / (the first number of times + the second number of times)). In a particular example, the confidence score <NUM> is lower for the false positive rate <NUM> that is higher than a false positive threshold. For example, if the indicator <NUM> is reported (or detected) more often in association with non-malicious activity, the indicator <NUM> is less likely to be associated with potential malicious activity.

The description keywords <NUM> (e.g., "scanning") indicate particular keywords detected in descriptions of the plurality of reports associated with the indicator <NUM>. The keyword tags <NUM> (e.g., "exfil") indicate particular keywords detected in tags associated with the plurality of reports. In a particular example, the confidence score <NUM> is higher for the indicator <NUM> if the lookup data <NUM> indicates that the description keywords <NUM> (e.g., "scanning"), the keyword tags <NUM> (e.g., "exfil"), or a combination thereof, have previously been associated with malicious activity. To illustrate, the confidence score <NUM> is higher if the keyword tags <NUM> (e.g., "exfil") indicate a particular activity (e.g., exfiltration or extraction).

The kill chain phase <NUM> (e.g., C2) indicates a stage of the network threat reportedly associated with the indicator <NUM> in a kill chain (e.g., a cyber kill chain®). The kill chain includes multiple stages, such as reconnaissance (e.g., probing for a weakness), weaponization (e.g., building a deliverable payload), delivery (e.g., sending the payload, such as a malicious link), exploit (e.g., executing code at a target's computer), installation (e.g., installing malware on a target asset), C2 (e.g., creating a channel to control a system remotely), and actions (e.g., remotely perform a malicious action). In a particular example, the impact score <NUM> is higher for the kill chain phase <NUM> that is associated with a higher stage (or phase) in the kill chain. To illustrate, if the indicator <NUM> is reportedly associated with a particular phase in the kill chain (e.g., C2), the potential malicious activity associated with the indicator <NUM> is likely to have a more severe impact.

The attribution identifier <NUM> (e.g., Fluffy Bunny) indicates a perpetrator reportedly associated with the indicator <NUM>. In a particular example, the impact score <NUM> is higher for the attribution identifier <NUM> that indicates a perpetrator associated with malicious activity having a more severe impact (e.g., more damaging, more widespread, or both). To illustrate, if the indicator <NUM> is reportedly associated with a particular attribution identifier that indicates a perpetrator that has previously participated in malicious activity having a more severe impact, the potential malicious activity associated with the indicator <NUM> is likely to have a more severe impact.

The attack type <NUM> (e.g., malware) indicates a type of network attack reportedly associated with the indicator <NUM>. The threat type <NUM> (e.g., malicious IP) indicates a type of network threat reportedly associated with the indicator <NUM>. The indicator type <NUM> (e.g., IPv4 Address) indicates a type of the indicator <NUM>. For example, the indicator type <NUM> can include an IP address, a virus signature, an e-mail address, an e-mail subject, a domain name, a URI, a URL, a filename, a MD5 hash, a file path, or a combination thereof. In a particular example, the impact score <NUM> is higher for the attack type <NUM>, the threat type <NUM>, the indicator type <NUM>, or a combination thereof, associated with malicious activity having a more severe impact (e.g., more damaging, more widespread, or both). To illustrate, if the indicator <NUM> is reportedly associated with a particular attack type, a particular threat type, a particular indicator type, or a combination thereof, that have previously resulted in malicious activity having a more severe impact, the potential malicious activity associated with the indicator <NUM> is likely to have a more severe impact.

In a particular implementation, the historical data <NUM> indicates that malicious activity associated with the kill chain phase <NUM> (e.g., C2), the attack type <NUM> (e.g., malware), the threat type <NUM> (e.g., malicious IP), the description keywords <NUM> (e.g., "scanning"), the keyword tags <NUM> (e.g., "exfil"), the indicator type <NUM>, or a combination thereof, has previously been detected and a corresponding impact severity. In this implementation, the threat report analyzer <NUM> determines the impact score <NUM> based on the impact severity.

The attribution confidence <NUM> (e.g., High) indicates a reported likelihood that the indicator <NUM> is associated with the perpetrator indicated by the attribution identifier <NUM>. In a particular example, the confidence score <NUM> is higher for the indicator <NUM> if the attribution confidence <NUM> is high.

The source count <NUM> (e.g., <NUM>) indicates a count of sources that have provided at least one report associated with the indicator <NUM>. For example, the second device <NUM> (or the first source) generates the network threat report <NUM> indicating that the indicator <NUM> is reportedly associated with malicious activity. As another example, the third device <NUM> (or the second source) and the fourth device <NUM> (or the third source) generate the first data <NUM> and the second data <NUM>, respectfully, indicating that the indicator <NUM> is reported associated with malicious activity. The threat report analyzer <NUM> determines the source count <NUM> (e.g., <NUM>) based on a count of the sources (e.g., the first source, the second source, and the third source) from which at least one report is received indicating that the indicator <NUM> is associated with malicious activity. In a particular example, the confidence score <NUM> is higher for the indicator <NUM> if the source count <NUM> (e.g., <NUM>) is higher.

The source reputation score <NUM> (e.g., high or <NUM>) indicates a level of trust associated with a source. In a particular aspect, the source reputation score <NUM> indicates a level of trust associated with the sources of the plurality of reports and the network threat report <NUM> indicates the source reputation score <NUM>. In another aspect, the source reputation score <NUM> indicates a level of trust associated with a particular source, such as the first source (e.g., the second device <NUM>) of the network threat report <NUM>. In this aspect, the threat report analyzer <NUM> retrieves the source reputation score <NUM> from the memory <NUM>. For example, the historical data <NUM> indicates the source reputation score <NUM> and the threat report analyzer <NUM> updates the source reputation score <NUM> to the value indicated by the historical data <NUM>. In another example, the source reputation score <NUM> is based on the lookup data <NUM> (e.g., a configuration setting, default data, the user input <NUM>, or a combination thereof). For example, the lookup data <NUM> indicates the source reputation score <NUM> for the first source (e.g., the second device <NUM>). In a particular example, the confidence score <NUM> is higher for the indicator <NUM> if the source reputation score <NUM> (e.g., High) is higher.

The targeted <NUM> (e.g., Yes) indicates whether the indicator <NUM> is reportedly associated with a targeted network threat. For example, the indicator <NUM> can be associated with a network threat that targets a particular organization, a particular person, or both. In a particular example, the impact score <NUM> is higher for the indicator <NUM> if the targeted <NUM> (e.g., Yes) indicates that the indicator <NUM> is reportedly associated with a targeted network threat. In a particular example, the impact score <NUM> (e.g., high) is higher for the indicator <NUM> if the targeted <NUM> indicates that the indicator <NUM> is reportedly associated with a targeted network threat directed at a large or sensitive target, such as a hospital, a school, an airport, an electric grid, a government department, a financial institution, or a government official. In this example, the impact score <NUM> (e.g., medium) is lower for the indicator <NUM> if the targeted <NUM> indicates that the indicator <NUM> is reportedly associated with a targeted network threat directed at a small or obscure target.

In a particular example, the threat report analyzer <NUM> generates the additional sources data <NUM> (e.g., <NUM>/<NUM>). For example, the threat report analyzer <NUM> sends requests to additional sources for information regarding the indicator <NUM>. To illustrate, the threat report analyzer <NUM> sends the first request <NUM> to the third device <NUM> (e.g., a second source), the second request <NUM> to the fourth device <NUM> (e.g., a third source), or both. The first request <NUM>, the second request <NUM>, or both, include the indicator <NUM>. The threat report analyzer <NUM> receives data from the additional sources indicating whether the indicator <NUM> has been detected as reportedly associated with a network threat. For example, the threat report analyzer <NUM> receives the first data <NUM> from the third device <NUM>, the second data <NUM> from the fourth device <NUM>, or both. The threat report analyzer <NUM> generates (or updates) the additional sources data <NUM> (e.g., <NUM>/<NUM>) indicating a count of the additional sources from which data is received indicating that the indicator <NUM> has been reported as associated with a network threat (e.g., the additional sources data <NUM> = a count of sources from which data indicating that the indicator <NUM> has been reported as associated with a network threat is received / a count of sources from which data associated with the indicator <NUM> is requested). In a particular example, the confidence score <NUM>, the impact score <NUM>, or both, are higher for the indicator <NUM> if the additional sources data <NUM> (e.g., <NUM>/<NUM>) indicates that a higher count of sources indicate that the indicator <NUM> is reportedly associated with a network threat.

The manually applied actions <NUM> (e.g., Block - Proxy) indicate actions (e.g., the action <NUM>) corresponding to the indicator <NUM> that have been initiated (or recommended) based on a user request. For example, the threat report analyzer <NUM> receives the network threat report <NUM>, generates the GUI <NUM> including the indicator <NUM>, provides the GUI <NUM> to the display device <NUM>, and receives the user input <NUM> requesting (or recommending) the first actions (e.g., Block - Proxy) associated with the indicator <NUM>. The threat report analyzer <NUM> determines at least some of the properties <NUM> subsequent to receiving the user input <NUM> requesting the first actions. For example, the threat report analyzer <NUM>, in response to receiving the user input <NUM>, determines that the manually applied actions <NUM> include the first actions (e.g., Block - Proxy). In a particular example, the network threat report <NUM> indicates that the first source (e.g., the second device <NUM> or a user of the second device <NUM>) has recommended second actions (e.g., the action <NUM>) corresponding to the indicator <NUM>. The manually applied actions <NUM> include the first actions, the second actions, or a combination thereof. In a particular aspect, the threat report analyzer <NUM> initiates performance of the manually applied actions <NUM> (e.g., Block - Proxy). The threat report analyzer <NUM> determines (or updates) the confidence score <NUM>, the impact score <NUM>, the overall score <NUM>, or a combination thereof, subsequent to determining the manually applied actions <NUM>. In a particular example, the confidence score <NUM> is higher for the indicator <NUM> if the manually applied actions <NUM> include at least one action corresponding to the indicator <NUM>, a particular action (e.g., Block - Proxy) corresponding to the indicator <NUM>, or both.

The indicator creation date <NUM> (e.g., <NUM>/<NUM>/<NUM>) indicates a date at which the indicator <NUM> is detected by the first source (e.g., the second device <NUM>). For example, the indicator creation date <NUM> indicates a date at which the first source (e.g., the second device <NUM>) received (or detected) a report (e.g., a user post on a public forum) indicating that the indicator <NUM> is associated with malicious activity. In another example, the indicator creation date <NUM> corresponds to a date at which the network threat report <NUM> was authored (e.g., a creation date or an update date). In a particular example, the confidence score <NUM> is higher if the indicator creation date <NUM> is more recent. To illustrate, the threat report analyzer <NUM> determines, at a first time, an indicator age based on the indicator creation date <NUM> (e.g., the indicator age = first time - the indicator creation date <NUM>) and updates the confidence score <NUM> based on the indicator age. The confidence score <NUM> is lower for a higher indicator age. In a particular aspect, the threat report analyzer <NUM> updates (e.g., at particular time intervals) the confidence score <NUM>, the impact score <NUM>, the overall score <NUM>, the position <NUM>, or a combination thereof, of the indicator <NUM> stored in the response queue <NUM>. The indicator <NUM> may thus lose priority the longer the indicator <NUM> is stored in the response queue <NUM> as higher priority indicators (e.g., the indicator <NUM>) are processed earlier and more indicators are added to the response queue <NUM>.

The internal hits <NUM> (e.g., <NUM>) indicates a number of times that indicator <NUM> is detected in network traffic. For example, the historical data <NUM> includes network logs, system logs, or both, that track network traffic in a particular network portion of the network <NUM>. The particular network portion is considered internal to an organization associated with the first device <NUM>. The last internal hit date <NUM> (e.g., <NUM>/<NUM>/<NUM>) indicates a most recent date at which the indicator <NUM> is detected in the particular network portion. In a particular aspect, the threat report analyzer <NUM> determines the action <NUM> based on at least some of the properties <NUM>, as further described with reference to <FIG>. For example, the threat report analyzer <NUM> determines a potential business impact of various actions (e.g., blocking all network traffic associated with the indicator <NUM> or blocking some network traffic associated with the indicator <NUM>). To illustrate, the potential business impact is higher if the internal hits <NUM> (e.g., <NUM>) is higher, the last internal hit date <NUM> (e.g., <NUM>/<NUM>/<NUM>) is recent, or both.

The threat report analyzer <NUM> may refrain from selecting an action as the action <NUM> in response to determining that the potential business impact of the action is greater than a threshold business impact. In a particular aspect, the threat report analyzer <NUM> selects the action <NUM> independently of the potential business impact and adds the action <NUM> to a particular action queue of multiple action queues based on the potential business impact. For example, the threat report analyzer <NUM>, in response to determining that the potential business impact is greater than an impact threshold, adds the action <NUM> to a first action queue (e.g., the action queue <NUM>) of actions to be performed in response to an explicit user request. Alternatively, the threat report analyzer <NUM>, in response to determining that the potential business impact is less than or equal to the impact threshold, adds the action <NUM> to a second action queue (e.g., the action queue <NUM>) of actions to be performed unless an explicit user cancelation is received.

The threat report analyzer <NUM> thus determines the properties <NUM> based on the network threat report <NUM>, the first data <NUM>, the second data <NUM>, the historical data <NUM>, or a combination thereof. The properties <NUM> enable the threat report analyzer <NUM> to determine a priority (e.g., the overall score <NUM>) of the indicator <NUM>, as described with reference to <FIG>.

<FIG> includes a diagram <NUM> of an example calculation of the confidence score <NUM>. The diagram <NUM> includes a table <NUM>. A first column of the table <NUM> indicates examples of the properties <NUM>. A second column of the table <NUM> includes property values <NUM> as illustrative values of the examples of the properties <NUM> indicated in the first column. The properties <NUM> include the attribution confidence <NUM>, the source count <NUM>, the indicator type <NUM>, the indicator creation date <NUM>, and second source hits <NUM>. The second source hits <NUM> indicate a number of times that the indicator <NUM> is detected as reported by a second source (e.g., a trusted source). For example, the additional sources data <NUM> of <FIG> includes the second source hits <NUM>. The second source hits <NUM> (e.g., None) indicates a number of times (e.g., <NUM>) that the indicator <NUM> is indicated as reported in the first data <NUM> as associated with a network threat.

The threat report analyzer <NUM> determines scores <NUM> for the properties <NUM>. For example, the threat report analyzer <NUM> determines a first score (e.g., <NUM>), a second score (e.g., <NUM>), a third score (e.g., <NUM>), a fourth score (e.g., <NUM>), and a fifth score (e.g., <NUM>) in response to determining that the attribution confidence <NUM> has a first value (e.g., High), the source count <NUM> has a second value (e.g., <NUM>), the indicator type <NUM> has a third value (e.g., IPv4 Address), the indicator creation date <NUM> has a fourth value (e.g., <NUM>/<NUM>/<NUM>) and that the second source hits <NUM> has a fifth value (e.g., None), respectively. In a particular aspect, the threat report analyzer <NUM> determines the scores <NUM> based on the lookup data <NUM> (e.g., user input, configuration settings, default values, or a combination thereof) of <FIG>. For example, the lookup data <NUM> indicates a first score for a particular property (e.g., the keyword tags <NUM>) having a particular value (e.g., "exfil"). The threat report analyzer <NUM> determines the confidence score <NUM> based on the first score for the particular property. For example, the threat report analyzer <NUM> determines that the attribution confidence <NUM> has the first score (e.g., <NUM>) in response to determining that the attribution confidence <NUM> has the first value (e.g., High) and that the lookup data <NUM> indicates that the first score (e.g., <NUM>) is to be assigned to the attribution confidence <NUM> having the first value (e.g., High). A third column of the table <NUM> includes illustrative values of the scores <NUM> for the examples of the properties <NUM> indicated in the first column.

The threat report analyzer <NUM> determines weights <NUM> for the properties <NUM>. For example, the threat report analyzer <NUM> assigns a first weight (e.g., <NUM>%), a second weight (e.g., <NUM>%), a third weight (e.g., <NUM>%), a fourth weight (e.g., <NUM>%), and a fifth weight (e.g., <NUM>%) to the attribution confidence <NUM>, the source count <NUM>, the indicator type <NUM>, the indicator creation date <NUM>, and the second source hits <NUM>, respectively. In a particular aspect, the threat report analyzer <NUM> determines the weights <NUM> based on the lookup data <NUM> indicating that the attribution confidence <NUM>, the source count <NUM>, the indicator type <NUM>, the indicator creation date <NUM>, and the second source hits <NUM> are to be assigned the first weight (e.g., <NUM>%), the second weight (e.g., <NUM>%), the third weight (e.g., <NUM>%), the fourth weight (e.g., <NUM>%), and the fifth weight (e.g., <NUM>%), respectively. A fourth column of the table <NUM> includes illustrative values of the weights <NUM> for the examples of the properties <NUM> indicated in the first column. The calculation of the confidence score <NUM> can thus be customized for particular properties by designating (e.g., in the lookup data <NUM>) particular weights for the properties and by designating (e.g., in the lookup data <NUM>) particular scores for particular values of the properties.

The threat report analyzer <NUM> determines weighted scores <NUM> for the properties <NUM> based on the scores <NUM> and the weights <NUM>. For example, the threat report analyzer <NUM> assigns a first weighted score (e.g., the first score * the first weight), a second weighted score (e.g., the second score * the second weight), a third weighted score (e.g., the third score * the third weight), a fourth weighted score (e.g., the fourth score * the fourth weight), and a fifth weighted score (e.g., the fifth score * the fifth weight) to the attribution confidence <NUM>, the source count <NUM>, the indicator type <NUM>, the indicator creation date <NUM>, and the second source hits <NUM>, respectively. A fifth column of the table <NUM> includes illustrative values of the weighted scores <NUM> for the examples of the properties <NUM> indicated in the first column.

The threat report analyzer <NUM> determines the confidence score <NUM> (e.g., <NUM>/<NUM>) for the properties <NUM> based on the weighted scores <NUM>. For example, the threat report analyzer <NUM> determines the confidence score <NUM> (e.g., <NUM>/<NUM>) based on a sum of the weighted scores <NUM> (e.g., the confidence score <NUM> = the first weighted score + the second weighted score + the third weighted score + the fourth weighted score + the fifth weighted score) assigned to the attribution confidence <NUM>, the source count <NUM>, the indicator type <NUM>, the indicator creation date <NUM>, and the second source hits <NUM>.

The diagram <NUM> includes a table <NUM>. The table <NUM> indicates an illustrative value (e.g., <NUM>/<NUM>) for the confidence score <NUM> corresponding to the examples of the properties <NUM> indicated in the table <NUM>. The threat report analyzer <NUM> assigns a rating <NUM> to the confidence score <NUM>. Ranges <NUM> of the confidence score <NUM> correspond to various ratings. In a particular aspect, the lookup data <NUM> indicates the ranges <NUM>. The diagram <NUM> includes a table <NUM> indicating illustrative values for the ranges <NUM>. The table <NUM> indicates that a first rating (e.g., unknown), a second rating (e.g., low), a third rating (e.g., medium), and a fourth rating (e.g., high) correspond to a first range (e.g., <NUM>-<NUM>), a second range (e.g., <NUM>-<NUM>), a third range (e.g., <NUM>-<NUM>), and a fourth range (e.g., <NUM>-<NUM>), respectively. The threat report analyzer <NUM> determines that the confidence score <NUM> corresponds to the second rating (e.g., low) in response to determining that the second range (e.g., <NUM> - <NUM>) includes the confidence score <NUM> (e.g., <NUM>). The threat report analyzer <NUM> thus determines the confidence score <NUM> based on at least some of the properties <NUM>.

<FIG> includes a diagram <NUM> of an example calculation of the impact score <NUM>. The diagram <NUM> includes a table <NUM>. A first column of the table <NUM> indicates examples of the properties <NUM>. A second column of the table <NUM> includes property values <NUM> as illustrative values of the examples of the properties <NUM> indicated in the first column. The properties <NUM> include the attack type <NUM>, the threat type <NUM>, and the attribution identifier <NUM>.

The threat report analyzer <NUM> determines the impact score <NUM> based on weighted scores <NUM>. First, the threat report analyzer <NUM> determines scores <NUM> for the properties <NUM>. For example, the threat report analyzer <NUM> determines a first score (e.g., <NUM>), a second score (e.g., <NUM>), and a third score (e.g., <NUM>) in response to determining that the attack type <NUM> has a first value (e.g., malware), the threat type <NUM> has a second value (e.g., malicious IP), and the attribution identifier <NUM> has a third value (e.g., Fluffy Bunny), respectively. In a particular aspect, the threat report analyzer <NUM> determines the scores <NUM> based on the lookup data <NUM> of <FIG>. For example, the lookup data <NUM> indicates a second score for a particular property (e.g., the keyword tags <NUM>) having a particular value (e.g., "exfil"). The threat report analyzer <NUM> determines the impact score <NUM> based on the second score for the particular property. The second score to determine the impact score <NUM> can be the same as or distinct from a first score (indicated by the lookup data <NUM>) to determine the confidence score <NUM>. In a particular example, the threat report analyzer <NUM> determines that the attack type <NUM> has the first score (e.g., <NUM>) in response to determining that the attack type <NUM> has the first value (e.g., malware) and that the lookup data <NUM> indicates that the first score (e.g., <NUM>) is to be assigned to the attack type <NUM> having the first value (e.g., malware). A third column of the table <NUM> includes illustrative values of the scores <NUM> for the examples of the properties <NUM> indicated in the first column.

The threat report analyzer <NUM> determines weights <NUM> for the properties <NUM>. For example, the threat report analyzer <NUM> assigns a first weight (e.g., <NUM>%), a second weight (e.g., <NUM>%), and a third weight (e.g., <NUM>%) to the attack type <NUM>, the threat type <NUM>, and the attribution identifier <NUM>, respectively. In a particular aspect, the threat report analyzer <NUM> determines the weights <NUM> based on the lookup data <NUM> indicating that the attack type <NUM>, the threat type <NUM>, and the attribution identifier <NUM> are to be assigned the first weight (e.g., <NUM>%), the second weight (e.g., <NUM>%), and the third weight (e.g., <NUM>%), respectively. A fourth column of the table <NUM> includes illustrative values of the weights <NUM> for the examples of the properties <NUM> indicated in the first column. The calculation of the impact score <NUM> can thus be customized for particular properties by designating (e.g., in the lookup data <NUM>) particular weights for the properties and by designating (e.g., in the lookup data <NUM>) particular scores for particular values of the properties.

The threat report analyzer <NUM> determines the weighted scores <NUM> for the properties <NUM> based on the scores <NUM> and the weights <NUM>. For example, the threat report analyzer <NUM> assigns a first weighted score (e.g., the first score * the first weight), a second weighted score (e.g., the second score * the second weight), and a third weighted score (e.g., the third score * the third weight) to the attack type <NUM>, the threat type <NUM>, and the attribution identifier <NUM>, respectively. A fifth column of the table <NUM> includes illustrative values of the weighted scores <NUM> for the examples of the properties <NUM> indicated in the first column.

The threat report analyzer <NUM> determines the impact score <NUM> (e.g., <NUM>/<NUM>) for the properties <NUM> based on the weighted scores <NUM>. For example, the threat report analyzer <NUM> determines the impact score <NUM> (e.g., <NUM>/<NUM>) based on a sum of the weighted scores <NUM> (e.g., the impact score <NUM> = the first weighted score + the second weighted score + the third weighted score) assigned to the attack type <NUM>, the threat type <NUM>, and the attribution identifier <NUM>.

The diagram <NUM> includes a table <NUM>. The table <NUM> indicates an illustrative value (e.g., <NUM>/<NUM>) for the impact score <NUM> corresponding to the examples of the properties <NUM> indicated in the table <NUM>. The threat report analyzer <NUM> assigns a rating <NUM> to the impact score <NUM>. Ranges <NUM> of the impact score <NUM> correspond to various ratings. In a particular aspect, the lookup data <NUM> indicates the ranges <NUM>. The diagram <NUM> includes a table <NUM> indicating illustrative values for the ranges <NUM>. The table <NUM> indicates that a first rating (e.g., unknown), a second rating (e.g., low), a third rating (e.g., medium), and a fourth rating (e.g., high) correspond to a first range (e.g., <NUM>-<NUM>), a second range (e.g., <NUM>-<NUM>), a third range (e.g., <NUM>-<NUM>), and a fourth range (e.g., <NUM>-<NUM>), respectively. For example, the threat report analyzer <NUM> determines that the impact score <NUM> corresponds to the third rating (e.g., medium) in response to determining that the third range (e.g., <NUM> - <NUM>) includes the impact score <NUM> (e.g., <NUM>). The threat report analyzer <NUM> thus determines the impact score <NUM> based on at least some of the properties <NUM>.

<FIG> includes a diagram <NUM> of examples <NUM>-<NUM> of the properties <NUM> and the action <NUM> corresponding to particular property values <NUM>-<NUM>. In a first example <NUM>, the property values <NUM> indicate that the properties <NUM> include the indicator type <NUM> having a first value (e.g., IPv4 address), the internal hits <NUM> having a second value (e.g., <NUM>), the confidence score <NUM> having a third value (e.g., <NUM>), and the impact score <NUM> having a fourth value (e.g., <NUM>).

In the first example <NUM>, the threat report analyzer <NUM> determines that the action <NUM> associated with the indicator <NUM> has a low potential business impact because the second value (e.g., <NUM>) of the internal hits <NUM> is below an internal hit threshold (e.g., <NUM>). The threat report analyzer <NUM> determines that the third value (e.g., <NUM>) of the confidence score <NUM> corresponds to the rating <NUM> (e.g., a medium rating) based on the ranges <NUM> of <FIG> and that the fourth value (e.g., <NUM>) of the impact score <NUM> corresponds to the rating <NUM> (e.g., a medium rating) based on the ranges <NUM> of <FIG>.

In a particular aspect, the threat report analyzer <NUM> selects more aggressive actions as the action <NUM> in response to determining that a first criterion is satisfied. In a particular implementation, the threat report analyzer <NUM> determines that the first criterion is satisfied in response to determining that the action <NUM> has a low potential business impact, that the confidence score <NUM> (e.g., <NUM>) satisfies a confidence threshold (e.g., greater than or equal to <NUM>), that the impact score <NUM> (e.g., <NUM>) satisfies an impact threshold (e.g., greater than or equal to <NUM>), or a combination thereof. In a particular implementation, the lookup data <NUM> of <FIG> indicates the first criterion to be satisfied for selection of more aggressive actions as the action <NUM>. The threat report analyzer <NUM>, in response to determining that the first criterion is satisfied, sets the action <NUM> to include blocking proxy traffic and email traffic associated with the indicator <NUM> and monitoring proxy traffic, email traffic, reverse proxy (RP) traffic, virtual private network (VPN) traffic, and external web logs associated with the indicator <NUM>.

In a second example <NUM>, property values <NUM> indicate that the properties <NUM> include the indicator type <NUM> having a first value (e.g., Domain Name), the internal hits <NUM> having a second value (e.g., <NUM>), the last internal hit date <NUM> having a third value (e.g., <NUM>/<NUM>), the confidence score <NUM> having a fourth value (e.g., <NUM>), and the impact score <NUM> having a fifth value (e.g., <NUM>). In the second example <NUM>, the threat report analyzer <NUM> determines that the second value (e.g., <NUM>) of the internal hits <NUM> indicates a high business impact because the second value is greater than the internal hit threshold (e.g., <NUM>) and that the third value (e.g., <NUM>/<NUM>) indicates a low business impact because the third value is prior to a hit threshold date (e.g., more than a year old). The threat report analyzer <NUM> determines, based on the second value and the third value, that the action <NUM> associated with the indicator <NUM> has a medium potential business impact. The threat report analyzer <NUM> determines that the fourth value (e.g., <NUM>) of the confidence score <NUM> corresponds to the rating <NUM> (e.g., a low rating) based on the ranges <NUM> of <FIG> and that the fifth value (e.g., <NUM>) of the impact score <NUM> corresponds to the rating <NUM> (e.g., a medium rating) based on the ranges <NUM> of <FIG>.

In a particular aspect, the threat report analyzer <NUM> selects medium-aggressive actions as the action <NUM> in response to determining that a second criterion is satisfied. In a particular implementation, the threat report analyzer <NUM> determines that the second criterion is satisfied in response to determining that the action <NUM> has a medium potential business impact, that the confidence score <NUM> (e.g., <NUM>) fails to satisfy a confidence threshold (e.g., less than <NUM>), that the impact score <NUM> (e.g., <NUM>) satisfies an impact threshold (e.g., greater than or equal to <NUM>), or a combination thereof. In another implementation, the threat report analyzer <NUM> determines that the second criterion is satisfied in response to determining that the action <NUM> has a medium potential business impact and that the impact score <NUM> (e.g., <NUM>) satisfies an impact threshold (e.g., greater than or equal to <NUM>). In a particular implementation, the lookup data <NUM> of <FIG> indicates the second criterion to be satisfied for selection of medium-aggressive actions as the action <NUM>. The threat report analyzer <NUM>, in response to determining that the second criterion is satisfied, sets the action <NUM> to include blocking proxy traffic associated with the indicator <NUM> and monitoring proxy traffic, email traffic, RP traffic, virtual private network (VPN) traffic, and external web logs associated with the indicator <NUM>.

In a third example <NUM>, the property values <NUM> indicate that the properties <NUM> include the indicator type <NUM> having a first value (e.g., IPv4 address), the internal hits <NUM> having a second value (e.g., <NUM>,<NUM>), the last internal hit date <NUM> having a third value (e.g., <NUM> days ago), the confidence score <NUM> having a fourth value (e.g., <NUM>), and the impact score <NUM> having a fifth value (e.g., <NUM>). In the third example <NUM>, the threat report analyzer <NUM> determines that the second value (e.g., <NUM>,<NUM>) of the internal hits <NUM> indicates a high business impact because the second value is greater than the internal hit threshold (e.g., <NUM>) and that the third value (e.g., <NUM> days ago) indicates a high business impact because the third value is subsequent to a hit threshold date (e.g., one week ago). The threat report analyzer <NUM> determines, based on the second value and the third value that the action <NUM> associated with the indicator <NUM> has a high potential business impact.

In a particular aspect, the threat report analyzer <NUM> selects non-aggressive actions as the action <NUM> in response to determining that a third criterion is satisfied. In a particular implementation, the threat report analyzer <NUM> determines that the third criterion is satisfied in response to determining that the action <NUM> has a high potential business impact, that the confidence score <NUM> (e.g., <NUM>) fails to satisfy a confidence threshold (e.g., less than <NUM>), and that the impact score <NUM> (e.g., <NUM>) fails to satisfy an impact threshold (e.g., less than <NUM>), or a combination thereof. In a particular implementation, the lookup data <NUM> of <FIG> indicates the third criterion to be satisfied for selection of non-aggressive actions as the action <NUM>. The threat report analyzer <NUM>, in response to determining that the third criterion is satisfied, sets the action <NUM> to indicate that no actions are to be taken. In another example, the threat report analyzer <NUM>, in response to determining that the third criterion is satisfied, sets the action <NUM> to include monitoring proxy traffic, email traffic, RP traffic, virtual private network (VPN) traffic, and external web logs associated with the indicator <NUM>. In a particular implementation, the threat report analyzer <NUM>, in response to determining that the third criterion is satisfied, selects aggressive or medium aggressive actions as the action <NUM> and adds the action <NUM> in a first action queue (e.g., the action queue <NUM>) of actions to be performed in response to user approval.

It should be understood that the examples included in <FIG> are illustrative and not meant to be limiting. The threat report analyzer <NUM> can select various actions to be performed based on various properties associated with the indicator <NUM>. Although various thresholds have been described with respect to <FIG>, the system <NUM> may include multiple thresholds corresponding to a particular property of the properties <NUM>.

<FIG> is a flowchart of a method <NUM> of network threat indicator extraction and response. The method <NUM> can be performed by one or more of the threat report analyzer <NUM>, the first device <NUM>, or the system <NUM> of <FIG>.

The method <NUM> includes receiving a network threat report, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> receives the network threat report <NUM>, as described with reference to <FIG>.

The method <NUM> also includes extracting an indicator from the network threat report, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> extracts the indicator <NUM> from the network threat report <NUM>. The indicator <NUM> is reported to be associated with a network threat.

The method <NUM> can include extracting a property associated with the indicator from the network threat report, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> extracts the indicator type <NUM>, the threat type <NUM>, the attack type <NUM>, the registration date <NUM>, the first seen date <NUM>, the last seen date <NUM>, the first reported date <NUM>, the last reported date <NUM>, the source reputation score <NUM> of the first source (e.g., the second device <NUM>), the description keywords <NUM>, the kill chain phase <NUM>, the attribution identifier <NUM>, the attribution confidence <NUM>, or a combination thereof, from the network threat report <NUM>, as described with reference to <FIG>.

Alternatively or in addition, the method <NUM> can include determining a property associated with the indicator, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> determines the report volume <NUM>, the false positive rate <NUM>, or both, as described with reference to <FIG>.

The method <NUM> further includes determining, based on the indicator, a confidence score indicating a likelihood that the indicator is associated with malicious activity, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> determines the confidence score <NUM> based on the indicator <NUM>, as further described with reference to <FIG> and <FIG>. To illustrate, the threat report analyzer <NUM> determines the confidence score <NUM> based on at least one of the indicator type <NUM>, the threat type <NUM>, the attack type <NUM>, the registration date <NUM>, the first seen date <NUM>, the last seen date <NUM>, the first reported date <NUM>, the last reported date <NUM>, the source reputation score <NUM> of the first source (e.g., the second device <NUM>), the description keywords <NUM>, the kill chain phase <NUM>, the attribution identifier <NUM>, the attribution confidence <NUM>, the report volume <NUM>, or the false positive rate <NUM>, as described with reference to <FIG>. The confidence score <NUM> indicates a likelihood that the indicator <NUM> is associated with malicious activity.

The method <NUM> also includes determining, based on the indicator, an impact score indicating a potential severity of the malicious activity, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> determines the impact score <NUM> based on the indicator <NUM>, as further described with reference to <FIG> and <FIG>. To illustrate, the threat report analyzer <NUM> determines the impact score <NUM> based on at least one of the indicator type <NUM>, the threat type <NUM>, the attack type <NUM>, the registration date <NUM>, the first seen date <NUM>, the last seen date <NUM>, the first reported date <NUM>, the last reported date <NUM>, the source reputation score <NUM> of the first source (e.g., the second device <NUM>), the description keywords <NUM>, the kill chain phase <NUM>, the attribution identifier <NUM>, the attribution confidence <NUM>, the report volume <NUM>, or the false positive rate <NUM>, as described with reference to <FIG> and <FIG>. The impact score <NUM> indicates a potential severity of the malicious activity.

The method <NUM> further includes identifying, based on the indicator, the confidence score, and the impact score, an action to be performed, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> identifies the action <NUM> based on the indicator <NUM>, the confidence score <NUM>, and the impact score <NUM>, as described with reference to <FIG>. The action <NUM> includes blocking network traffic corresponding to the indicator <NUM>, monitoring network traffic corresponding to the indicator <NUM>, or both, as described with reference to <FIG> and <FIG>.

The method <NUM> also includes initiating performance of the action <NUM>, at <NUM>. For example, the threat report analyzer <NUM> of <FIG> initiates performance of the action <NUM>, as described with reference to <FIG>. To illustrate, the threat report analyzer <NUM> can perform the action <NUM> independently of (e.g., in the absence of) user input indicating that the action <NUM> is to be performed.

The method <NUM> thus enables the action <NUM> corresponding to the indicator <NUM> to be identified based on the likelihood that the indicator <NUM> is associated with malicious activity and the potential severity of the malicious activity. The action <NUM> can be performed without receiving any user input indicating that the action <NUM> is to be performed. Earlier performance of the action <NUM> enables prevention of the corresponding malicious activity.

<FIG> is an illustration of a block diagram of a computing environment <NUM> including a computing device <NUM> configured to support aspects of computer-implemented methods and computer-executable program instructions (or code) according to the present disclosure. For example, the computing device <NUM>, or portions thereof, is configured to execute instructions to initiate, perform, or control one or more operations described with reference to <FIG>.

The computing device <NUM> includes the transceiver <NUM>. The transceiver <NUM> includes a transmitter antenna <NUM> and a receiver antenna <NUM>. The computing device <NUM> includes a processor <NUM>. In a particular aspect, the processor <NUM> includes the threat report analyzer <NUM>. The processor <NUM> is configured to communicate with system memory <NUM>, one or more storage devices <NUM>, one or more input/output interfaces <NUM>, one or more communication interfaces <NUM>, or a combination thereof. The system memory <NUM> includes volatile memory devices (e.g., random access memory (RAM) devices), nonvolatile memory devices (e.g., read-only memory (ROM) devices, programmable read-only memory, and flash memory), or both. The system memory <NUM> stores an operating system <NUM>, which may include a basic input/output system for booting the computing device <NUM> as well as a full operating system to enable the computing device <NUM> to interact with users, other programs, and other devices. The system memory <NUM> stores system (program) data <NUM>. In a particular aspect, the memory <NUM> of <FIG> includes the system memory <NUM>, the one or more storage devices <NUM>, or a combination thereof.

The system memory <NUM> includes one or more applications <NUM> executable by the processor <NUM>. As an example, the one or more applications <NUM> include instructions executable by the processor <NUM> to initiate, control, or perform one or more operations described with reference to <FIG>. To illustrate, the one or more applications <NUM> include instructions executable by the processor <NUM> to initiate, control, or perform one or more operations described with reference to the threat report analyzer <NUM>.

The processor <NUM> is configured to communicate with one or more storage devices <NUM>. For example, the one or more storage devices <NUM> include nonvolatile storage devices, such as magnetic disks, optical disks, or flash memory devices. In a particular example, the storage devices <NUM> include both removable and non-removable memory devices. The storage devices <NUM> are configured to store an operating system, images of operating systems, applications, and program data. In a particular aspect, the system memory <NUM>, the storage devices <NUM>, or both, include tangible computer-readable media. In a particular aspect, one or more of the storage devices <NUM> are external to the computing device <NUM>.

The processor <NUM> is configured to communicate with one or more input/output interfaces <NUM> that enable the computing device <NUM> to communicate with one or more input/output devices <NUM> to facilitate user interaction. In a particular aspect, the input/output interfaces <NUM> include the input interface <NUM>, the output interface <NUM> of <FIG>, or both. The processor <NUM> is configured to detect interaction events based on user input received via the input/output interfaces <NUM>. Additionally, the processor <NUM> is configured to send a display to the display device <NUM> of <FIG> via the input/output interfaces <NUM>. The processor <NUM> is configured to communicate with devices or controllers <NUM> via the one or more communication interfaces <NUM>. For example, the one or more communication interfaces <NUM> include the communication interface <NUM> of <FIG>. In an illustrative example, a non-transitory computer-readable storage medium (e.g., the system memory <NUM>) includes instructions that, when executed by a processor (e.g., the processor <NUM>), cause the processor to initiate, perform, or control operations. The operations include one or more operations described with reference to <FIG>.

Examples described above are illustrative and do not limit the disclosure. It is to be understood that numerous modifications and variations are possible in accordance with the principles of the present disclosure.

The illustrations of the examples described herein are intended to provide a general understanding of the structure of the various implementations. Many other implementations may be apparent to those of skill in the art upon reviewing the disclosure. Other implementations may be utilized and derived from the disclosure, such that structural and logical substitutions and changes may be made without departing from the scope of the disclosure. For example, method operations may be performed in a different order than shown in the figures or one or more method operations may be omitted.

Moreover, although specific examples have been illustrated and described herein, it should be appreciated that any subsequent arrangement designed to achieve the same or similar results may be substituted for the specific implementations shown. This disclosure is intended to cover any and all subsequent adaptations or variations of various implementations. Combinations of the above implementations, and other implementations not specifically described herein, will be apparent to those of skill in the art upon reviewing the description.

Claim 1:
A method performed by a device, the method comprising:
receiving (<NUM>) a network threat report;
extracting (<NUM>) an indicator from the network threat report, the indicator being indicated in the network threat report as reported to be associated with a network threat;
determining (<NUM>), based on the indicator, a confidence score indicating a likelihood that the indicator is associated with malicious activity;
determining (<NUM>), based on the indicator, an impact score indicating a potential severity of the malicious activity; and
performing an action identified (<NUM>) based on the indicator, the confidence score, and the impact score, wherein the action includes blocking network traffic corresponding to the indicator or monitoring network traffic corresponding to the indicator.