Patent Document ID: 9674210
Application ID: 14554492
Patent Flag: 1

Claim One:
1. A method comprising steps of: obtaining data characterizing host devices of a computer network of an enterprise; applying the data to a logistic regression model to generate malware infection risk scores for respective ones of the host devices; and taking one or more proactive measures to prevent malware infection in one or more of the host devices based at least in part on the malware infection risk scores; wherein the malware infection risk scores indicate likelihoods that the respective host devices will become infected with malware; wherein the logistic regression model incorporates a plurality of features of the host devices as respective model variables including at least user demographic features, virtual private network (VPN) activity features and web activity features of the host devices; wherein the user demographic features incorporated by the logistic regression model comprise at least one of user level in enterprise hierarchy and user technical level; wherein the VPN activity features incorporated by the logistic regression model comprise number of VPN connections and duration of the VPN connections; wherein the web activity features incorporated by the logistic regression model comprise web usage features and domain reputation features, the web usage features comprising number of distinct domains visited and the domain reputation features comprising number of connections challenged by web proxy and number of connections consented by web proxy; wherein the data characterizing the host devices comprises data for the plurality of features incorporated by the logistic regression model; and wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.