Patent ID: 8914880

Claim:
A method for calculating the probability of a cyber security incident for a computer within a group of computers comprising: a. collecting program file names, checksums, and locations within file systems on one or more computers in the group of computers, where an identity of a program file is determined by a unique file identifier of that program file; b. storing in an electronic memory the unique file identifier for each program file, a unique computer identifier for each computer; c. storing in an electronic memory for each program file a list of computer identifiers on which the file was found; d. determining a plurality of program file bundles by comparing the lists of computer identifiers for program files and bundling program files with similar computer lists; e. associating computers with program file bundles by associating any computer that contained any program file in a bundle with that bundle; f. accessing security incident history data for each computer such that each unique computer identifier is associated with data indicating a history of security incidents on that computer; g. calculating a bundle probability value for a program file bundles by examining computers associated with that bundle and determining a value based on the ratio of those computers that have previously or currently been involved in a security incident to those computers never involved in a security, h. calculating a probability of a cyber security incident for the computer by summing probabilities values for one or more program file bundles present on the computer; and i. reporting or outputting the probability of a cyber security incident for the computer.