System and method for evaluating network threats and usage

摘要

Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.

主权项

1. A system for detecting computer network threats, the system comprising:
one or more computer hardware processors that execute specific code instructions to cause the system to at least:
receive a network address from a first data source, the first data source comprising a computing system connected to a network, the computing system configured to receive network traffic;determine a threat indicator for the network address, wherein the threat indicator indicates a risk level associated with the network address, and wherein the threat indicator is based at least in part on:
a quantity of occurrences of the network address in the first data source,a cumulative time between respective occurrences of the network address in the first data source and a first time, anda likelihood that a perceived threat of the network address is an actual threat, wherein the likelihood is based at least in part on historical data of past threat events from the first data source; andprovide the threat indicator to an entity device, wherein the entity device is configured to block the network address based at least in part on the threat indicator.