System and method for determining a decayed threat score

1. A computerized system comprising:

a computer processor;

a memory configured to store instructions, the instructions when executed by the computer processor are operable to:

determine a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;

calculate a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;

determine an aggregate threat score based on the decayed threat score; and

suspend, based on the aggregate threat score, user activity corresponding to one or more of:

a particular computer user;

a particular computer application; and

a particular activity.

2. The computerized system of claim 1 , wherein the damping factor is a value between 0 and 1.

3. The computerized system of claim 1 , wherein the determined threat score is reduced to a decayed threat score based on a determination that the user action is non-threatening.

4. The computerized system of claim 1 , wherein:

the instructions when executed by the computer processor are further operable to identify a risk level corresponding to the determined threat score, wherein the risk level comprises a range of threat scores; and

the decayed threat score is reduced at a maximum to a minimum value in the range of the corresponding risk level.

5. A computer-implemented method performed by a computing device comprising at least one processor, the method comprising:

determining a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;

calculating a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;

determining an aggregate threat score based on the decayed threat score; and

suspending, based on the aggregate threat score, user activity corresponding to one or more of:

a particular computer user;

a particular computer application; and

a particular activity.

6. The computer-implemented method of claim 5 , wherein the damping factor is a value between 0 and 1.

7. The computer-implemented method of claim 5 , wherein the determined threat score is reduced to a decayed threat score based on a determination that the user action is non-threatening.

8. The computer-implemented method of claim 5 , further comprising:

identifying a risk level corresponding to the determined threat score, wherein the risk level comprises a range of threat scores; and

wherein the decayed threat score is reduced at a maximum to a minimum value in the range of the corresponding risk level.

9. One or more computer-readable non-transitory storage media in one or more computing systems, the media embodying logic that is operable when executed by a computer processor to:

determine a threat score for a user action in a computer application, the threat score being indicative of a risk presented by the user action;

calculate a decayed threat score based on the determined threat score, a damping factor, and a damping interval, the decayed threat score being a modified threat score for the user action, the damping factor being a constant value used to reduce the determined threat score, and the damping interval corresponding to a frequency in which the determined threat score is reduced;

determine an aggregate threat score based on the decayed threat score; and

suspend, based on the aggregate threat score, user activity corresponding to one or more of:

a particular computer user;

a particular computer application; and

a particular activity.

10. The media of claim 9 , the media embodying logic that is further operable when executed by the computer processor to:

identify a risk level corresponding to the determined threat score, wherein the risk level comprises a range of threat scores; and

wherein the decayed threat score is reduced at a maximum to a minimum value in the range of the corresponding risk level.