Aggregate Threat Score Calculation Using Decayed Weights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems are inadequate in accurately evaluating security risks associated with user actions, as they rely on singular threat scores that do not account for user behavior patterns and are often too rigid, leading to inaccurate flagging of users and applications as security risks.
Innovation Solution
A computer-implemented method determines an aggregate threat score by summing individual threat scores and calculating contributions based on the difference between the maximum threat score and each individual score, also considering decayed threat scores over time to account for non-threatening actions, thereby providing a more accurate representation of security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security systems use singular threat scores to evaluate user actions, then the evaluation process is simple and fast, but the accuracy of risk assessment deteriorates because it does not account for user behavior patterns
Solution Approach 1:
The patent segments the threat score calculation into multiple components: individual threat scores for specific actions, decayed threat scores for historical context, and an aggregate threat score that combines both. This segmentation allows the system to maintain computational efficiency while improving accuracy by evaluating multiple factors separately before synthesizing a comprehensive risk assessment.
Solution Approach 2:
The patent introduces dynamic elements by incorporating decayed threat scores that change over time based on user behavior patterns. Instead of using static singular threat scores, the system dynamically adjusts the weight of historical actions based on their recency and relevance, allowing the risk assessment to adapt to changing user behaviors while maintaining manageable computational complexity.
2Reliability
If traditional security systems use rigid threat score thresholds, then the system operation is simple, but false positives increase leading to inaccurate flagging of users and applications
Solution Approach 1:
The patent implements feedback mechanisms by incorporating decayed threat scores that reflect historical user behavior patterns. The system continuously learns from past actions and adjusts future evaluations accordingly, providing feedback that reduces false positives. This feedback loop maintains operational simplicity by automating the learning process while significantly improving the reliability of user and application flagging decisions.
3Measurement precision
If the system calculates aggregate threat scores by summing all individual scores, then the comprehensive risk assessment is achieved, but the computational time increases
Solution Approach 1:
The patent applies partial action by using decayed threat scores that represent a condensed, time-weighted summary of historical actions rather than processing every individual historical action in full detail. This partial approach maintains the essential information needed for comprehensive risk assessment while significantly reducing computational time required to calculate the aggregate threat score.
Solution Approach 2:
The patent changes parameters by introducing time-decay factors that modify the weight of historical threat scores based on their age and relevance. This parameter transformation allows the system to maintain comprehensive risk assessment by incorporating historical context while reducing computational burden through mathematical optimization of how historical data is weighted and aggregated.
Data Source
AI summary
According to one embodiment, a computer-implemented method comprises determining a first threat score and a second threat score respectively corresponding to a first user action and a second user action on one or more computer applications and calculating an aggregate threat score for the determined threat scores. Calculating the aggregate threat score comprises summing together the first threat score and a contribution of the second threat score, wherein the contribution of the second threat score is determined based on the second threat score and a margin corresponding to the difference between a maximum threat score and the first threat score.