Dynamic threat event management system and method

1. A method for a content-driven threat management system, the method comprising:

creating a threat detection primary object with threat mitigation data using at least one researcher of at least one of software and malicious code;

encoding the threat detection primary object with threat mitigation data within an object capable of being transmitted to a personal computer system using a transmission vector update function;

transmitting the object comprising the encoded threat detection primary object with threat mitigation data to a threat agent using the transmission vector update function;

updating a first threat function using the threat agent to update at least one first threat functional description of the first threat function to include the threat detection primary object with threat mitigation data, the first threat function consisting of a first element chosen from the group consisting of a firewall, an anti-virus program, an anti-spyware program, a universal resource locator (URL) filter, and a URL management program;

updating a second threat function using the threat agent to update at least one second threat functional description of the second threat function to include the threat detection primary object with threat mitigation data that was included in the first threat functional description, the second threat function consisting of a second element chosen from the group, the second element different from the first element;

using the threat detection primary object with threat mitigation data to recognize at least one threat event based upon the threat detection primary object with threat mitigation data;

responding, by the first threat function, to the at least one threat event as directed by the threat detection primary object by executing one or more functions of the first threat function; and

responding, by the second threat function, to the at least one threat event as directed by the threat detection primary object by executing one or more functions of the second threat function.

2. The method of claim 1 further comprising:

responding to the at least one threat event as directed by the threat detection primary object with threat mitigation data, including executing at least one function of the first threat function, comprising at least communicating to at least one of the threat agent, the second threat function, and a command and control monitor function; and

executing at least one function of the at least one of the threat agent, the second threat function, and the command and control monitor function, each capable of developing a secondary object capable of being communicated to at least one of the threat agent, the first threat function, the second threat function, and the command and control monitor function, wherein the threat detection primary object with threat mitigation data further comprises at least one of a functional threat mitigation mechanism and a functional threat description mechanism.

3. The method of claim 2 , wherein the threat detection primary object with threat mitigation data further comprising the at least one of the functional threat mitigation mechanism and the functional threat description mechanism further comprises at least one of spyware, a firewall, anti-virus software, spam filter information, Trojan Horse information, universal resource locator filtering, universal resource locator management, policy configuration, and threat posture information.

4. The method of claim 1 , wherein the threat agent is at least one of resident on a single system in a non-distributed framework, found in a trusted relationship with a different system on a network in a distributed framework, and found in the trusted relationship with the different system on a set of networks and systems in the distributed framework.

5. The method of claim 2 , wherein the threat agent is at least one of resident on a single system in a non-distributed framework, found in a trusted relationship with a different system on a network in a distributed framework, and found in the trusted relationship with the different system on a set of networks and systems in the distributed framework.

6. The method of claim 3 , wherein the threat agent is at least one of resident on a single system in a non-distributed framework, found in a trusted relationship with a different system on a network in a distributed framework, and found in the trusted relationship with the different system on a set of networks and systems in the distributed framework.

7. The method of claim 2 further comprising:

reviewing information found at a command and control console having the command and control monitor function, wherein reviewing information found at the command and control console is performed by at least one of a user, a manager, and a participator.

8. The method of claim 7 further comprising:

determining at least one more secondary object capable of being communicated to at least one of the threat agent, the first threat function, and the second threat function.

9. A method for a content-driven threat management system, the method comprising:

creating a threat detection primary object P(n) with threat mitigation data using researchers of at least one of software and malicious code;

encoding the threat detection primary object P(n) with threat mitigation data within an object capable of being transmitted to a personal computer system using a transmission vector update function U(n);

transmitting the object comprising the encoded threat detection primary object P(n) with threat mitigation data to a threat agent A(n) using the transmission vector update function U(n);

updating at least one threat function N(m) using the threat agent A(n) to update at least one threat functional description of the at least one threat function N(m) to include the threat detection primary object P(n) with threat mitigation data, the threat function N(m) consisting of a first element chosen from a group consisting of a firewall, an anti-virus program, an anti-spyware program, a universal resource locator (URL) filter, and a URL management program;

updating at least one second threat function using the threat agent A(n) to update at least one second threat functional description of the at least one second threat function to include the threat detection primary object P(n) with threat mitigation data, the second threat function N(m) consisting of a second element chosen from the group, the second element different from the first element;

using the threat detection primary object P(n) with threat mitigation data to recognize at least one threat event based upon the threat detection primary object P(n) with threat mitigation data;

responding, by the first threat function, to the at least one threat event as directed by the threat detection primary object P(n) with threat mitigation data, including executing at least one function of the threat function N(m), comprising at least communicating to at least one of the threat agent A(n), at least one other threat function N(k) where k≠m, and a command and control monitor function M(n);

responding, by the second threat function, to the at least one threat event as directed by the threat detection primary object P(n) with threat mitigation data; and

executing at least one function of the at least one of the threat agent A(n), the at least one other threat function N(k) where k≠m, and the command and control monitor function M(n) , each capable of developing a secondary object S(n) capable of being communicated to at least one of the threat agent A(n), the at least one threat function N(m), the at least one other threat function N(k) where k≠m, and the command and control monitor function M(n).

10. The method of claim 9 , wherein the threat detection primary object P(n) with threat mitigation data further comprises at least one of a functional threat mitigation mechanism and a functional threat description mechanism.

11. The method of claim 10 , wherein the threat detection primary object P(n) with threat mitigation data further comprising the at least one of the functional threat mitigation mechanism and the functional threat description mechanism further comprises at least one of spyware, a firewall, anti-virus software, spam filter information, Trojan Horse information, universal resource locator filtering, universal resource locator management, policy configuration, and threat posture information.

12. The method of claim 9 , wherein the threat agent A(n) is at least one of resident on a single system in a non-distributed framework, found in a trusted relationship with a different system on a network in a distributed framework, and found in the trusted relationship with the different system on a set of networks and systems in the distributed framework.

13. The method of claim 9 further comprising:

reviewing information found at a command and control console having the command and control monitor function M(n), wherein reviewing information found at the command and control console is performed by at least one of a user, a manager, and a participator.

14. The method of claim 13 further comprising:

determining at least one more secondary object S(n) capable of being communicated to at least one of the threat agent A(n), the at least one threat function N(m), and the at least one other threat function N(k) where k≠m.

15. A method for a content-driven threat management system, the method comprising:

creating a threat detection primary object P(n) with threat mitigation data using researchers of at least one of software and malicious code;

encoding the threat detection primary object P(n) with threat mitigation data within an object capable of being transmitted to a personal computer system using a transmission vector update function U(n) ;

transmitting the object comprising the encoded threat detection primary object P(n) with threat mitigation data to a threat agent A(n) using the transmission vector update function U(n) ;

updating a plurality of threat functions N( 1 ), N( 2 ), . . . , N(m) using the threat agent A(n) to update at least one threat functional description of each of the plurality of threat functions N( 1 ), N( 2 ), . . . , N(m) to include the threat detection primary object P(n) with threat mitigation data, each of the threat functions consisting of a distinct element chosen from the group consisting of a firewall, an anti-virus program, an anti-spyware program, a universal resource locator (URL) filter, and a URL management program;

using the threat detection primary object P(n) with threat mitigation data to recognize at least one threat event based upon the threat detection primary object P(n) with threat mitigation data;

responding, by the first threat function, to the at least one threat event as directed by the threat detection primary object P(n) with threat mitigation data, including executing at least one function of N(j) , one of the plurality of threat functions N( 1 ), N( 2 ), . . . , N(m), comprising at least communicating to at least one of the threat agent A(n), at least one other threat function N(k) where k≠j, and a command and control monitor function M (n);

responding, by the second threat function, to the at least one threat event as directed by the threat detection primary object P(n) with threat mitigation data; and

executing at least one function of the at least one of the threat agent A(n), the at least one other threat function N(k) where k≠j, and the command and control monitor function M(n), each capable of developing a secondary object S(n) capable of being communicated to at least one of the threat agent A(n), at least one of the threat functions N(j) where j=1, 2, . . . ,m, and the command and control monitor function M(n).

16. The method of claim 15 , wherein the threat detection primary object P(n) with threat mitigation data further comprises at least one of a functional threat mitigation mechanism and a functional threat description mechanism.

17. The method of claim 16 , wherein the threat detection primary object P(n) with threat mitigation data further comprising the at least one of the functional threat mitigation mechanism and the functional threat description mechanism further comprises at least one of spyware, a firewall, anti-virus software, spam filter information, Trojan Horse information, universal resource locator filtering, universal resource locator management, policy configuration, and threat posture information.

18. The method of claim 15 , wherein the threat agent A(n) is at least one of resident on a single system in a non-distributed framework, found in a trusted relationship with a different system on a network in a distributed framework, and found in the trusted relationship with the different system on a set of networks and systems in the distributed framework.

19. The method of claim 15 further comprising:

reviewing information found at a command and control console having the command and control monitor function M(n), wherein reviewing information found at the command and control console is performed by at least one of a user, a manager, and a participator.

20. The method of claim 19 further comprising:

determining at least one more secondary object S(n) capable of being communicated to at least one of the threat agent A(n) and at least one of the threat functions N(j) where j=1,2, . . . ,m.

21. The method of claim 1 further comprising:

creating, by the first threat function, a threat detection secondary object with threat mitigation data;

transmitting the threat detection secondary object from the first threat function to the second threat function; and

responding, by the second threat function, as directed by the threat detection secondary object.