Dynamic regional network enclave with active threat intelligence

1 . A computing platform comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

obtain historical intelligence information corresponding to a plurality of intelligence parameters, wherein the plurality of intelligence parameters comprise: government intelligence, open source intelligence, and indicators of compromise (IOC);

train, using the historical intelligence information, an enclave management model, wherein training the enclave management model configures the enclave management model to identify network actions to address current intelligence information, to produce threat scores, and to identify regional enclaves, each defining network boundaries for the respective regional enclaves, and wherein the enclave management model comprises a supervised machine learning model, wherein training the enclave management model comprises configuring a first weight value of 0.3 for the government intelligence parameter, a second weight value of 0.3 for the open source intelligence parameter, and a third weight value of 0.4 for the IOC parameter;

receive first current intelligence information corresponding to the plurality of intelligence parameters;

input, into the enclave management model, the current intelligence information, wherein inputting the current intelligence information into the enclave management model causes the enclave management model to produce a threat score for a first enclave and first network actions to address the current intelligence information;

compare the threat score to a threat threshold; and

based on identifying that the threat score meets or exceeds the threat threshold, send one or more commands directing one or more network switching devices, corresponding to the first enclave, to execute the first network actions, wherein sending the one or more commands directing the one or more network switching devices to execute the first network actions causes the one or more network switching devices to execute the first network actions.

2 . The computing platform of claim 1 , wherein the plurality of intelligence parameters further comprise: internet information, real time event information, risk indicators, sanction information, local regulations, cyber threat information, geographic information, and regionally specific threat profile information.

3 . The computing platform of claim 1 , wherein training the enclave management model comprises training a supervised machine learning model by labelling the historical intelligence information with a threat indicator prior to inputting the historical intelligence information into the enclave management model for training.

4 . The computing platform of claim 1 , wherein the memory stores additional computer readable instructions that, when executed by the at least one processor, cause the computing platform to:

obtain network switching information defining location and connection information for the one or more network switching devices.

5 . The computing platform of claim 4 , wherein training the enclave management model comprises establishing a switch matrix, based on the network switching information, defining correlations between a plurality of geographic regions, including a first geographic region, and corresponding network enclaves, comprising network switching devices, of the one or more network switching devices, configured to establish a network boundary for the corresponding geographic region.

6 . The computing platform of claim 1 , wherein the first current intelligence information corresponds to a plurality of different geographic regions.

7 . The computing platform of claim 1 , wherein the threat threshold is specific to the first enclave, and wherein at least one other enclave has a different threat threshold.

8 . The computing platform of claim 1 , wherein the first network actions comprise:

causing the one or more network switching devices to isolate the first enclave,

causing the one or more network switching devices to isolate a second enclave, different than the first enclave,

causing the one or more network switching devices to modify a boundary of the first enclave,

causing the one or more network switching devices to modify a boundary of a second enclave,

causing the one or more network switching devices to log inbound network traffic, and

causing the one or more network switching devices to route the inbound network traffic to an isolation system for analysis.

9 . The computing platform of claim 8 , wherein the second enclave corresponds to an origin of a threat identified in the current intelligence information.

10 . The computing platform of claim 1 , wherein the memory stores additional computer readable instructions that, when executed by the at least one processor, cause the computing platform to:

identify, at a second time, after a first time at which the threat score is produced, that an updated threat score for the first enclave is less than the threat threshold; and

based on identifying that the updated threat score is lower than the threat threshold, suspending the first network actions.

11 . The computing platform of claim 1 , wherein the supervised machine learning model comprises a decision tree model, an ensemble model, a neural network, a linear regression model, an artificial neural network, logistic regression model, and a support vector machine.

12 . The computing platform of claim 1 , wherein training the enclave management model comprises training, once the enclave management model has been trained using supervised learning techniques, the enclave management model using unsupervised learning techniques.

13 . The computing platform of claim 12 , wherein the unsupervised learning techniques include classiciation, regression, clustering, anomaly detection, and artificial neutral networks.

14 . The computing platform of claim 1 , wherein the first enclave defines a geographic boundary.

15 . The computing platform of claim 1 , wherein the first enclave defines a non-geographic boundary, corresponding to one of an enterprise or a group of individuals within the enterprise characterized by a common job title, wherein the enterprise or the group of individuals spans across multiple geographic regions.

16 . The computing platform of claim 1 , wherein:

comparing the threat score to the threat threshold further includes comparing the threat score to a plurality of threat score ranges to identify which of the plurality of threat score ranges the threat score falls within,

each of the plurality of threat score ranges is associated with a particular network security action, and is dynamically adjustable, and

sending the one or more commands directing the one or more network switching devices to execute the first network actions comprises the particular network security action associated with a threat score range into which the threat score falls.

17 . The computing platform of claim 16 , wherein the plurality of threat score ranges includes three threshold ranges, including:

a first threshold range including threat scores between 0 and 3 inclusive,

a second threshold range, including threat scores between 4 and 7 inclusive, and

a third threshold range including threat scores between 8 and 10 inclusive.

18 . The computing platform of claim 16 , wherein the plurality of threat score ranges are associated with the first enclave, wherein a second plurality of threat score ranges are associated with a second enclave, different than the first enclave, and wherein the second plurality of threat score ranges are different than the plurality of threat score ranges.

19 . A method comprising:

at a computing platform comprising at least one processor, a communication interface, and memory:

obtaining historical intelligence information corresponding to a plurality of intelligence parameters, wherein the plurality of intelligence parameters comprise: government intelligence, open source intelligence, and indicators of compromise (IOC);

training, using the historical intelligence information, an enclave management model, wherein training the enclave management model configures the enclave management model to identify network actions to address current intelligence information, to produce threat scores, and to identify regional enclaves, each defining network boundaries for the respective regional enclaves, and wherein the enclave management model comprises a supervised machine learning model, wherein training the enclave management model comprises configuring a first weight value of 0.3 for the government intelligence parameter, a second weight value of 0.3 for the open source intelligence parameter, and a third weight value of 0.4 for the IOC parameter;

receiving first current intelligence information corresponding to the plurality of intelligence parameters;

inputting, into the enclave management model, the current intelligence information, wherein inputting the current intelligence information into the enclave management model causes the enclave management model to produce a threat score for a first enclave and first network actions to address the first current intelligence information;

comparing the threat score to a threat threshold; and

based on identifying that the threat score meets or exceeds the threat threshold, sending one or more commands directing one or more network switching devices, corresponding to the first enclave, to execute the first network actions, wherein sending the one or more commands directing the one or more network switching devices to execute the first network actions causes the one or more network switching devices to execute the first network actions.

20 . One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

obtain historical intelligence information corresponding to a plurality of intelligence parameters, wherein the plurality of intelligence parameters comprise: government intelligence, open source intelligence, and indicators of compromise (IOC);

train, using the historical intelligence information, an enclave management model, wherein training the enclave management model configures the enclave management model to identify network actions to address current intelligence information, to produce threat scores, and to identify regional enclaves, each defining network boundaries for the respective regional enclaves, and wherein the enclave management model comprises a supervised machine learning model, wherein training the enclave management model comprises configuring a first weight value of 0.3 for the government intelligence parameter, a second weight value of 0.3 for the open source intelligence parameter, and a third weight value of 0.4 for the IOC parameter;

receive first current intelligence information corresponding to the plurality of intelligence parameters;

input, into the enclave management model, the current intelligence information, wherein inputting the current intelligence information into the enclave management model causes the enclave management model to produce a threat score for a first enclave and first network actions to address the first current intelligence information;

compare the threat score to a threat threshold; and

based on identifying that the threat score meets or exceeds the threat threshold, send one or more commands directing one or more network switching devices, corresponding to the first enclave, to execute the first network actions, wherein sending the one or more commands directing the one or more network switching devices to execute the first network actions causes the one or more network switching devices to execute the first network actions.