Patent Document ID: 9800605
Application ID: 14928773
Patent Flag: 1

Claim One:
1. A method of assessing a threat of an attack within a computer infrastructure of an enterprise, comprising: aggregating a plurality of singular direct threat indicators, each of which said direct threat indicators represents an event that indicates a known singular direct threat within said computer infrastructure with a plurality of singular behavioral threat indicators each of which represents an anomalous behavioral action that is indicative of a possible singular behavioral threat within said computer infrastructure to create a threat detection model that identifies combinations of different ones of said singular direct and singular behavioral threat indicators that represent different composite threats within said computer infrastructure; determining for each of said singular direct and behavioral threat indicators an associated risk factor for each type of threat represented by such threat indicators, said associated risk factor each being determined based upon a probability that a threat associated with such risk factor is an actual threat, and calculating corresponding risk scores for each said type of threat); identifying using said threat detection model combinations of said singular direct and behavioral threat indicators that correspond to composite threats; computing a composite threat risk score for each said composite threat as a weighted probability of the risk scores of said one or more said singular direct and behavioral threat indicators that in combination correspond to said composite threat; and detecting a likely attack due to said composite threat based upon a computed probability value of said composite threat risk score.