Dynamic adaptive defense for cyber-security threats
View Patent ↗Disclosed is a cyber-security system that is configured to aggregate and unify data from multiple components and platforms on a network. The system allows security administrators can to design and implement a workflow of device-actions taken by security individuals in response to a security incident. Based on the nature of a particular threat, the cyber-security system may initiate an action plan that is tailored to the security operations center and their operating procedures to protect potentially impacted components and network resources.
1. A method of responding to a cyber-security attack, comprising:
receiving a cyber-security alert for a cyber-security attack at a cyber-data management node, the cyber-data management node operating on a server associated with a network;
analyzing the received cyber-security alert by a mediation component of the cyber-data management node to determine, from a plurality of cyber-security responses and based on a network security policy, a cyber-security response including information of at least one countermeasure and information of at least one network security element operatively coupled to the cyber-data management node;
displaying a plurality of icons by a reporting component of the cyber-data management node including a countermeasure icon for the at least one countermeasure and a network security element icon for the at least one network security element, the countermeasure icon and the network security element icon having an association that is graphically represented within a graphical user interface in response to a user input selecting at least one of the countermeasure icon or the network security element icon, the countermeasure icon and the network security element icon lacking the association prior to receiving the user input; and
sending a signal to respond, in response to the user input, to the cyber-security attack by applying the at least one countermeasure to the at least one network security element.
2. The method of claim 1 , further comprising:
receiving the user input selecting the countermeasure icon; and
responding to the cyber-security attack by applying the at least one countermeasure to the at least one network security element responsive to the user input.
3. The method of claim 1 , further comprising:
receiving the user input selecting the network security element icon; and
responding to the cyber-security attack by applying the at least one countermeasure to the at least one network security element responsive to the user input.
4. The method of claim 1 , wherein:
the cyber-security response includes a plurality of countermeasures including the at least one countermeasure; and
the plurality of icons includes a plurality of countermeasure icons including the countermeasure icon, each one of the plurality of countermeasure icons corresponding to one of the plurality of countermeasures.
5. The method of claim 4 , further comprising:
receiving the user input selecting the countermeasure icon from the plurality of countermeasure icons, the countermeasure icon and the network security element icon having the association that is graphically represented within the graphical user interface in response to the user input.
6. The method of claim 4 , wherein:
the association is a first association;
the method further includes:
receiving the user input selecting the network security element icon, the plurality of countermeasure icons and the network security element icon having a second association that is graphically represented within the graphical user interface in response to the user input; and
responding to the cyber-security attack by applying, to the at least one network security element responsive to the user input, the plurality of the countermeasures corresponding to the plurality of the countermeasure icons that have the association with the network security element icon.
7. The method of claim 1 , wherein:
the cyber-security response includes a plurality of groups of countermeasures and a plurality of network security elements; and
the plurality of icons includes a plurality of groups of countermeasure icons and a plurality of network security element icons, each one of the plurality of groups of countermeasure icons corresponding to one of the plurality of groups of countermeasures, each one of the plurality of network security element icons corresponding to one of the plurality of network security elements.
8. The method of claim 7 , wherein:
the association is a first association;
the method further includes:
receiving the user input selecting the at least one network security element icon from the plurality of network security element icons, the plurality of groups of countermeasure icons and the network security element icon having a second association that is graphically represented within the graphical user interface in response to the user input; and
responding to the cyber-security attack by applying, to the at least one network security element corresponding to the network security element icon selected in response to the user input, the plurality of groups of countermeasures corresponding to the plurality of groups of countermeasure icons.
9. The method of claim 7 , wherein the plurality of network security element icons are arranged in a sequential order in the graphical user interface, the sequential order corresponding to an order in which the plurality of groups of countermeasure are to be applied in the response.
10. The method of claim 1 , wherein the at least one network security element is a network element that can be acted on by an activating and provisioning system associated with the cyber-data management node.
11. A system for responding to a cyber-security attack, comprising:
at least one processor;
at least one memory operably linked to the at least one processor, the at least one memory including instructions, which when executed on the at least one processor, cause the processor to
display a plurality of network security element icons in a network security map;
display a plurality of cyber-security countermeasure icons in the network security map;
receive a user input that correlates at least one network security element icon from the plurality of the network security elements icons with at least one cyber-security countermeasure icon from the plurality of the cyber-security countermeasure icons, the at least one network security element icon lacking correlations in the network security map with the at least one cyber-security countermeasure icon prior to receiving the user input; and
send a signal to apply a cyber-security countermeasure to a network security element responsive to the user input, the cyber-security countermeasure corresponding to the at least one cyber-security countermeasure icon, the network security element corresponding to the at least one network security element icon.
12. The system of claim 11 , wherein the at least one memory comprises further instructions, which when executed on the at least one processor, cause the processor to:
display an icon correlation area in the network security map;
the operation of receiving the user input includes receiving the user input that drags and drops the at least one network security element icon to the icon correlation area, and receiving the user input that drags and drops the at least one cyber-security countermeasure icon to the icon correlation area.
13. The method of claim 11 , wherein:
the receiving the user input includes receiving the user input that selects the at least one network security element icon displayed in the network security map;
the at least one memory includes further instructions, which when executed on the at least one processor, cause the processor to expand the at least one network security element icon responsive to the user input to display a plurality of sub-element icons each associated with the at least one network security element icon.
14. The method of claim 13 , wherein:
the user input is a first user input;
the at least one cyber-security countermeasure icon is a first cyber-security countermeasure icon;
the cyber-security countermeasure is a first cyber-security countermeasure;
the at least one memory includes further instructions, which when executed on the at least one processor, cause the processor to:
receive a second user input that correlates at least one of the plurality of sub-element icons with a second cyber-security countermeasure icon from the plurality of the cyber-security countermeasure icons; and
apply a second cyber-security countermeasure to a network security sub-element responsive to the second user input, the second cyber-security counter measure corresponding to the second cyber-security countermeasure icon, the network security sub-element corresponding to the at least one of the plurality of sub-element icons.
15. The method of claim 11 , wherein the at least one memory comprises further instructions, which when executed on the at least one processor, cause the processor to:
receive a cyber-security alert for the cyber-security attack;
analyze the cyber-security alert to at least identify a source of the cyber-security attack; and
display an indication of the source of the cyber-security attack on the network security map.
16. The method of claim 15 , wherein the at least one memory comprises further instructions, which when executed on the at least one processor, cause the processor to:
compile information regarding the received cyber-security alert;
analyze the complied information and continue to compile information regarding the received cyber-security alert until a threshold amount of information regarding the cyber-security attack is obtained; and
output an expanded data set for the cyber-security attack including at least a portion of the complied information in combination with the network security map.
17. A system for responding to a cyber-security attack, comprising:
means for displaying a plurality of network security element icons in a network security map;
means for displaying a plurality of cyber-security countermeasure icons in the network security map;
means for receiving a user input that correlates at least one network security element icon from the plurality of the network security elements icons with at least one cyber-security countermeasure icon from the plurality of the cyber-security countermeasure icons, the at least one network security element icon lacking correlations in the network security map with the at least one cyber-security countermeasure icon prior to receiving the user input; and
means for sending a signal to apply a cyber-security countermeasure to a network security element responsive to the user input, the cyber-security countermeasure corresponding to the at least one cyber-security countermeasure icon, the network security element corresponding to the at least one network security element icon.
18. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
receive a cyber-security alert for a cyber-security attack at a cyber-data management node, the cyber-data management node operating on a server associated with a network;
analyze the received cyber-security alert to determine, from a plurality of cyber-security responses and based on a network security policy, a cyber-security response including information of at least one countermeasure and information of at least one network security element operatively coupled to the cyber-data management node;
send a first signal to cause display of a plurality of icons including a countermeasure icon for the at least one countermeasure and a network security element icon for the at least one network security element, the countermeasure icon and the network security element icon having a correlation that is graphically represented in a graphical user interface in response to a user input selecting at least one of the countermeasure icon or the network security element icon, the countermeasure icon and the network security element icon lacking the correlation prior to receiving the user input; and
send a second signal to respond, in response to the user input, to the cyber-security attack by applying the at least one countermeasure to the at least one network security element.
19. The method of claim 1 , wherein the association of the countermeasure icon and the network security element icon is a correlation that is graphically represented within the graphical user interface.
20. The method of claim 1 , wherein:
the cyber-security response includes a plurality of countermeasures and a plurality of network security elements;
the plurality of icons includes a plurality of countermeasure icons and a plurality of network security element icons, each countermeasure icon from the plurality of countermeasure icons uniquely associated with a countermeasure from the plurality of countermeasures, each network security element icon from the plurality of network security element icons associated with a network security element from the plurality of network security elements;
the method further includes:
receiving the user input selecting (1) a set of countermeasure icons from the plurality of countermeasure icons and (2) a set of network security element icons from the plurality of network security element icons, the set of countermeasure icons and the set of network security element icons having at least one association that is graphically represented within the graphical user interface in response to the user input; and
responding to the cyber-security attack by applying, to a set of network security elements associated with the set of network security element icons selected by the user input and from the plurality of network security elements, a set of countermeasures associated with the set of countermeasure icons selected by the user input and from the plurality of countermeasures.
21. The method of claim 1 , wherein:
the countermeasure icon is independent of the at least one network security element, and
the network security element icon is independent of the at least one countermeasure.