Patent ID: 7523504

Claim:
A computer implemented method for evaluating security of a network environment, the method comprising: analyzing security data associated with an asset in the network environment collected over a first period of time to detect security events occurring at a rate above a reference rate; analyzing security data associated with the asset collected over a second period of time, greater than the first period of time, to detect security events occurring at a rate below the reference rate; and generating a threat index based on the detected security events, wherein generating the threat index comprises: calculating an event index for the asset based on the security data associated with the asset collected over the second period of time; calculating an alert index for the asset based on the security data associated with the asset collected over the first period of time; and combining the event index and the alert index to provide the threat index; and wherein calculating the event index comprises calculating the event index using the following equation: Event Index= i Σ(2 i *(number of events with i ))/total number of events, wherein i comprises a severity index associated with the asset, wherein the number of events comprises a number of events associated with the asset having the severity index i during the second period of time and wherein the total number of events comprises a total number of events for the asset during the second period of time.