US 11,928,631 B2
Threat detection with business impact scoring
Russell Humphries, Surrey (GB); and Andrew J. Thomas, Oxfordshire (GB)
Assigned to Sophos Limited, Abingdon (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on Mar. 1, 2021, as Appl. No. 17/188,931.
Application 17/188,931 is a continuation of application No. 16/129,183, filed on Sep. 12, 2018, granted, now 10,938,839.
Claims priority of provisional application 62/726,174, filed on Aug. 31, 2018.
Prior Publication US 2021/0211441 A1, Jul. 8, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06Q 10/0635 (2023.01); G06F 9/54 (2006.01); G06F 11/07 (2006.01); G06F 16/955 (2019.01); G06F 17/18 (2006.01); G06F 18/21 (2023.01); G06F 18/214 (2023.01); G06F 18/23213 (2023.01); G06F 18/2413 (2023.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01); G06N 5/01 (2023.01); G06N 5/022 (2023.01); G06N 5/04 (2023.01); G06N 5/046 (2023.01); G06N 7/00 (2023.01); G06N 20/00 (2019.01); G06N 20/20 (2019.01); G06Q 10/0639 (2023.01); G06V 20/52 (2022.01); H04L 9/40 (2022.01); G06Q 30/018 (2023.01); G06Q 30/0283 (2023.01)
CPC G06Q 10/0635 (2013.01) [G06F 9/542 (2013.01); G06F 11/079 (2013.01); G06F 16/955 (2019.01); G06F 17/18 (2013.01); G06F 18/214 (2023.01); G06F 18/2178 (2023.01); G06F 18/23213 (2023.01); G06F 18/24143 (2023.01); G06F 21/554 (2013.01); G06F 21/56 (2013.01); G06F 21/562 (2013.01); G06F 21/565 (2013.01); G06N 5/01 (2023.01); G06N 5/022 (2013.01); G06N 5/04 (2013.01); G06N 5/046 (2013.01); G06N 7/00 (2013.01); G06N 20/00 (2019.01); G06N 20/20 (2019.01); G06Q 10/06395 (2013.01); G06V 20/52 (2022.01); H04L 63/0227 (2013.01); H04L 63/0263 (2013.01); H04L 63/1408 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01); H04L 63/1441 (2013.01); H04L 63/20 (2013.01); G06Q 30/0185 (2013.01); G06Q 30/0283 (2013.01)] 20 Claims
OG exemplary drawing
 
7. A method comprising:
providing a valuation model for automatically estimating a business value of a file, wherein providing the valuation model includes creating a model to estimate the business value based on a training set of files each having a known business value, wherein the business value is based on at least one of a file location and an access control list;
analyzing a plurality of files within an enterprise network for a threat level using an integrative model based on one or more of behavioral tags, executable file paths, and Uniform Resource Locators;
identifying one or more intermediate threats associated with the plurality of files that are not within a predetermined confidence level of safe or malicious according to the integrative model;
determining an estimated business value for each of the one or more intermediate threats using the valuation model;
ranking the one or more intermediate threats for presentation within a user interface based on a combination of a likelihood of maliciousness determined according to the integrative model and the estimated business value determined according to the valuation model; and
presenting the one or more intermediate threats to a user in the user interface for human evaluation.