Detection mitigation and remediation of cyberattacks employing an advanced cyber-decision platform
A system for mitigation of cyberattacks employing an advanced cyber decision platform comprising a time series data retrieval module, a directed computational graph module, an outcome simulation module, and an observation module. The time series data retrieval module monitors cybersecurity related data from multiple sources, and continuously monitors traffic on a client network. The directed computational graph module analyzes the retrieved data for baseline pattern determination, and analyzes the data for anomalous occurrences. The outcome simulation module performs predictive simulation transformations on data provided by other modules of the platform and provides results as needed. The observation module formats data to maximize impact of included information and data.
1. A system for detection and mitigation of cyberattacks employing an advanced cyber decision platform comprising:
a time series data retrieval and storage module stored in a memory of and operating on a processor of a computing device;
a directed computational graph analysis module stored in a memory of and operating on a processor of a computing device;
an action outcome simulation module stored in a memory of and operating on a processor of a computing device; and
an observation and state estimation module stored in a memory of and operating on a processor of a computing device;
wherein the time series data retrieval and storage module: monitors cybersecurity-related data from a plurality of sources; continuously monitors network traffic in real-time on at least one client network; and stores retrieved and monitored data;
wherein the directed computational graph analysis module: retrieves a plurality of data from the time series data retrieval and storage module; analyzes at least a portion of retrieved data for baseline pattern determination; analyzes at least a portion of retrieved data for predetermined anomalous occurrences; performs real-time analysis of the network traffic data collected during the real-time traffic monitoring; generates alerts based on the real-time analysis, and provides relevant data and metadata to the action outcome simulation module;
wherein the action outcome simulation module: receives data and metadata for predictive simulation analysis from the directed computational graph analysis module; performs predictive simulation transformations on data provided by other modules of the advanced cyber decision platform; and provides results of predictive simulation analysis to predetermined modules of advanced cyber decision platform;
wherein the observation and state estimation module formats data received from other modules of the advanced cyber decision platform in ways predesigned to maximize conveyance of included information and data;
wherein at least a portion of the data retrieved by the time series data retrieval and storage module is cybersecurity intelligence data from a plurality of expert sources;
wherein at least a portion of simulations run by the action outcome simulation module comprise predictive discovery of resident network infrastructure vulnerabilities to a plurality of cyberexploits and provide at least one resultant correction recommendation;
wherein at least a portion of simulations run by the action outcome simulation module comprise network traffic sample data from a probable ongoing cyberattack to predict a timeline of progression of the probable ongoing cyberattack and at least one recommendation predicted mitigate effects of the probable ongoing cyberattack;
wherein at least a portion of output formatted by the observation and state estimation module is directed to indicate a focused actionable response from a subset of the set of those participating in cybersecurity response; and
wherein at least a portion of output formatted by the observation and state estimation module provides a specifically segmented subset of the available information for delivery to one or more cyberattack response groups having differing roles in the mitigation and recovery process.
2. The system of claim 1 , wherein at least a portion of baseline data analyzed by the directed computational graph analysis module is network equipment logs, network equipment configuration parameters, network topology information and network resident server logs for the purpose of predictively uncovering network vulnerabilities.
3. The system of claim 1 , wherein at least a portion of baseline data analyzed by the directed computational graph analysis module is the normal network usage traffic of at least one sanctioned network user.