Patent Document ID: 8572746
Application ID: 12691631
Patent Flag: 1

Claim One:
1. A method for determining a rating of a likelihood of a victim system receiving malicious traffic from an attacker system at a point in time, comprising: generating a first forecast from a time series model based on past history of attacks by the attacker system, generating a second forecast from a victim neighborhood model based on similarity between the victim system and peer victim systems; the second forecast r a,v kNN (t)of the attacker system a attacking the victim system v at the point in time t is generated based on a formula: r a , v kNN ⁡ ( t ) = ∑ u ∈ N k ⁡ ( v ; a ) ⁢ s uv ⁢ r a , u TS ⁡ ( t ) ∑ u ∈ N k ⁡ ( v ; a ) ⁢ s uv , ∀ t ∈ T test ; where S indicates a similarity measure such that s uv , indicates a similarity measure of the victim system v to neighbor victim system u; where N k (v;a) indicates a neighborhood of top k similar victims to victim system v according to the similarity measure; where r a,v kNN r(t) indicates the first forecast; and where T indicates a time period such that T test indicates a test window, and wherein k is a number of similar victims, and kNN is a k nearest neighbor victim; generating a third forecast from a joint attacker-victim neighborhood model based on correlation between a group of attacker systems including the attacker system and a group of victim systems including the victim system, wherein the correlation between the group of attacker systems and the group of victim systems is based on a three dimensional prediction matrix of the group of attacker systems and the group of victim systems in which intensity of the attacks vary with time; and determining the rating of the likelihood of the victim system receiving malicious traffic from the attacker system at the point in time based on the first forecast, the second forecast, and the third forecast, wherein at least one of: the generating of the first forecast, the generating of the second forecast, the generating of the third forecast or determining the rating is executed by a computer processor.