Systems and methods for detecting and mitigating cyber security threats
A cyber security system includes an attribute extractor to extract an event from a data resource, the event including an identifier associated with an originator and including an attribute; an attribute router in communication with the attribute extractor; an inference engine in communication with the attribute router and having an associated lattice, the lattice to receive the attribute and to generate a predictive event, the attribute router to route the event to the inference engine; and a monitoring server in communication with the inference engine, the inference engine to provide the predictive event to the monitoring server.
1 . A cyber security system comprising:
one or more hardware processors;
memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to implement:
an attribute extractor to extract an event from a data resource, the event including an identifier associated with an originator and including an attribute;
an attribute router in communication with the attribute extractor;
an inference engine in communication with the attribute router and having an associated lattice, the lattice to receive the attribute and to generate a predictive event, the attribute router to route the event to the inference engine; and
a monitoring server in communication with the inference engine, the inference engine to provide the predictive event to the monitoring server.
2 . The cyber security system of claim 1 , wherein the predictive event includes the identifier associated with the originator, a set of attributes including the attribute, an identity of the lattice, and a reached node within the lattice.
3 . The cyber security system of claim 2 , wherein the predictive event further includes a session identifier and a progress.
4 . The cyber security system of claim 1 , further comprising a progress forwarded to receive the predictive event from the inference engine and to provide the predictive event to the monitoring server.
5 . The cyber security system of claim 1 , wherein the inference engine includes a queue and inference threads.
6 . The cyber security system of claim 1 , wherein the inference engine includes the lattice and a lattice start attribute, the inference engine to start a new session when an attribute associated with the lattice start attribute is received.
7 . The cyber security system of claim 1 , wherein the inference engine further includes an output forwarder in communication with a prediction forwarder.
8 . The cyber security system of claim 1 , further comprising a deployment database.
9 . The cyber security system of claim 8 , wherein the deployment database includes an attribute-lattice database, the attribute router to select the inference engine at least in part based on the attribute-lattice database.
10 . The cyber security system of claim 8 , wherein the deployment database includes a lattice-lattice address database, the attribute router to select the inference engine at least in part based on the lattice-lattice address database.
11 . The cyber security system of claim 8 , wherein the deployment database includes a lattice database.
12 . A method for monitoring a computing environment, the method comprising:
detecting an event with an attribute extractor, the event associating an attribute with an identifier associated with an originator;
routing the event to an inference engine of a plurality of inference engines using an attribute router in communication with the attribute extractor, the attribute router selecting the inference engine based at least in part on the attribute and a lattice associated with the inference engine;
determining a predictive event with the inference engine, the predictive event including the identifier associated with the originator, a set of attributes including the attribute, an identity of the lattice, and a reached node; and
forwarding the predictive event to a monitoring server.
13 . The method of claim 12 , wherein a prediction forwarder receives the predictive event from the inference engine and forwards the predictive event to the monitoring server.
14 . The method of claim 12 , wherein the predictive event further includes a session identification.
15 . The method of claim 12 , wherein the predictive event further includes an indication of progress.
16 . The method of claim 12 , further comprising:
determining with the inference engine whether the attribute matches a lattice start attribute; and
starting a new session in response to the attribute matching the lattice start attribute.
17 . The method of claim 12 , further comprising determining with the inference engine a lattice position.
18 . The method of claim 17 , further comprising determining whether the lattice position is at a bottom position within the lattice and deleting the session when the lattice position is at the bottom.