Monitoring a computing system with respect to a recovery scenario

1 . A method performed by a security system for use in monitoring a computing system with respect to a recovery scenario from which the computing system would require recovery, the method comprising:

i) obtaining system recovery indicators for the computing system, wherein the system recovery indicators are associated with classifications indicating whether each system recovery indicator is a comparatively early indicator of the recovery scenario or a comparatively late indicator of the recovery scenario, when compared to other system recovery indicators, as the recovery scenario unfolds, and wherein a model further takes as input the classification for each system recovery indicator;

ii) predicting a likelihood that the computing system will undergo the recovery scenario from the system recovery indicators using the model trained using a machine learning process that takes as input the system recovery indicators and providing an associated one or more pre-emptive actions that should be performed based on a type of predicted recovery scenario; and

iii) responsive to the predicted likelihood, performing the one or more pre-emptive actions so as: to secure the computing system against occurrence of the recovery scenario; reduce impact of an emerging recovery scenario; or to enable the computing system to be recovered following occurrence of the recovery scenario; and wherein the pre-emptive actions comprise one or more of:

taking an image of part of the computing system; and

moving or encrypting data within the computing system.

2 . The method as in claim 1 , wherein the model outputs the likelihood that the computing system will undergo the recovery scenario.

3 . The method as in claim 2 , wherein the model has been trained using training data comprising a training example, each training example comprising: example system recovery indicators obtained for an example computing system, and a ground truth likelihood that said example computing system will undergo the recovery scenario.

4 . The method as in claim 3 , further comprising:

requesting the model from a repository comprising a plurality of trained models; and

responsive to determining that none of the trained models in the repository take as input the system recovery indicators, training the model, using the training data.

5 . The method of claim 1 , wherein the model is a decision tree or a random forest-based classifier.

6 . The method of claim 1 , wherein the system recovery indicators comprise data representing:

system access patterns;

traffic flow patterns through the system; and/or

indicators of system vulnerabilities.

7 . The method of claim 1 , wherein the system recovery indicators are determined during a predetermined sliding time interval.

8 . The method of claim 1 , wherein the likelihood that the computing system will undergo the recovery scenario is predicted for a predetermined time interval after the system recovery indicators were obtained.

9 . The method of claim 1 , wherein the recovery scenario is caused by:

an external attack on the computing system;

an internal security breach;

a system failure of the computing system;

an adverse environmental condition;

an uncontrolled system change; and/or

human error.

10 . The method of claim 1 , wherein the pre-emptive actions in addition comprise: applying a security control to the computing system.

11 . The method of claim 1 , further comprising:

repeating steps i) and ii) in an iterative manner on successive real-time system recovery indicators.

12 . A computer program product comprising non transitory computer readable media having stored thereon a computer program which when executed on at least one processor of a security system, cause the security system to carry out a method according to claim 1 .

13 . A security system for use in monitoring a computing system with respect to a recovery scenario from which the computing system would require recovery, the security system comprising:

a memory comprising instruction data representing a set of instructions; and

a processor configured to communicate with the memory and to execute the set of instructions, wherein the set of instructions, when executed by the processor, cause the security system to:

i) obtain system recovery indicators for the computing system, wherein the system recovery indicators are associated with classifications indicating whether each system recovery indicator is a comparatively early indicator of the recovery scenario or a comparatively late indicator of the recovery scenario, when compared to other system recovery indicators, as the recovery scenario unfolds, and wherein a model further takes as input the classification for each system recovery indicator;

ii) predict a likelihood that the computing system will undergo the recovery scenario from the system recovery indicators using the model trained using a machine learning process that takes as input the system recovery indicators and provide an associated one or more pre-emptive actions that should be performed based on a type of predicted recovery scenario; and

iii) responsive to the predicted likelihood, perform the one or more pre-emptive actions so as: to secure the computing system against occurrence of the recovery scenario; reduce impact of an emerging recovery scenario; or to enable the computing system to be recovered following occurrence of the recovery scenario; and wherein the pre-emptive actions comprise one or more of:

taking an image of part of the computing system; and

moving or encrypting data within the computing system.

14 . The security system as in claim 13 , wherein the model outputs the likelihood that the computing system will undergo the recovery scenario.

15 . The security system as in claim 14 , wherein the model has been trained using training data comprising a training example, each training example comprising: example system recovery indicators obtained for an example computing system, and a ground truth likelihood that said example computing system will undergo the recovery scenario.

16 . The security system as in claim 15 , wherein the set of instructions, when executed by the processor, further cause the security system to:

request the model from a repository comprising a plurality of trained models; and

responsive to determining that none of the trained models in the repository take as input the system recovery indicators, train the model, using the training data.

17 . The security system as in claim 13 , wherein the model is a decision tree or a random forest-based classifier.

18 . The security system as in claim 13 , wherein the system recovery indicators comprise data representing:

system access patterns;

traffic flow patterns through the system; and/or

indicators of system vulnerabilities.

19 . The security system as in claim 13 , wherein the system recovery indicators are determined during a predetermined sliding time interval.