Proactive prediction and mitigation of cyber-threats

1. A method for proactively predicting cyber-security threats, comprising:

receiving a plurality of security events classified to different groups of events;

processing the plurality of received security events in order to classify potential cyber-security threats into a set of correlation types;

determining a correlation score for each of the classified potential cyber-security threats by factoring at a correlation confidence level, a risk level of an identified threat, and a probability of the prediction; and

determining a prediction score for each of the classified potential cyber-security threats, wherein the prediction score is determined based in part on the correlation score.

2. The method of claim 1 , further comprising:

performing a mitigation action against the potential cyber-security threat, wherein the mitigation action is determined based on the prediction score and a security policy.

3. The method of claim 2 , wherein the mitigation action includes at least one of: blocking network traffic between at least one source and at least one destination, diverting network traffic, and generating alerts.

4. The method of claim 2 , further comprising: determining the mitigation action based on a cost for performing the mitigation.

5. The method of claim 1 , wherein a group of security events is any one of: a matched event and an advanced event, wherein the matched event is a security event matching at least one workflow rule, and wherein the advanced event is a matched event associated with an advanced attack caused by an identified cyber-security threat.

6. The method of claim 5 , wherein each of the set of correlation types is any one of: a common ancestor correlation type, an overlap cause correlation type, an overlap cause-effect correlation type, and a common descendant correlation type.

7. The method of claim 5 , wherein each of the set of correlation types determines how a potential cyber-security threat correlates to at least advanced events.

8. The method of claim 7 , wherein the common ancestor correlation type is determined when at least one advanced event is originated from a same ancestor source as a potential cyber-security threat.

9. The method of claim 7 , wherein the overlap cause correlation type is determined when at least one advanced event in a chain of advanced events overlaps at least one matched event, wherein the potential cyber-security threat is a premature threat of an advanced attack.

10. The method of claim 9 , wherein events are considered overlapped when at least one of: application paths' attributes and seed events' attributes are the same.

11. The method of claim 7 , wherein the common descendant correlation type is determined when at least one advanced event is destined to a same destination as a potential cyber-security threat.

12. The method of claim 11 , wherein any one of the common ancestor correlation type and the overlap cause correlation type is determined when a cause-effect matched event overlaps a cause-effect advanced event, wherein a potential cyber-security threat leads to a destination designated in the cause-effect matched event.

13. The method of claim 12 , wherein the two events are considered overlapping when said two events originate from the same source.

14. The method of claim 1 , wherein determining the correlation score further comprises:

factoring at least one of: a number of correlated events and a number of identified correlation types.

15. The method of claim 14 , wherein determining the prediction score further comprises:

factoring in addition to the correlation score at least one of: a type of an identified potential cyber-security threat, a risk level associated with the identified potential cyber-security threat, and at least one cause-and-effect attribute.

16. The method of claim 1 , wherein each potential cyber-security attack is at least a multi-vector attack campaign.

17. The method of claim 1 , wherein the multi-vector attack campaign is any one of: an insider threat campaign, a personal data-leak campaign, a ransomware campaign, an intelligence gathering, a financial data-leak campaign, and a denial-of-service (DoS) attack campaign.

18. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for proactively predicting cyber-security threats, the process comprising:

receiving a plurality of security events classified to different groups of events;

processing the plurality of received security events in order to classify potential cyber-security threats into a set of correlation types;

determining a correlation score for each classified potential cyber-security threats by factoring at a correlation confidence level, a risk level of an identified threat, and a probability of the prediction; and

determining a prediction score for each classified potential cyber-security threat, wherein the prediction score is determined based in part on the correlation score.

19. A cyber-security system for proactively predicting cyber-security threats, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

receive a plurality of security events classified to different groups of events;

process the plurality of received security events in order to classify potential cyber-security threats into a set of correlation types;

determine a correlation score for each of the classified potential cyber-security threats by factoring at a correlation confidence level, a risk level of an identified threat, and a probability of the prediction; and

determine a prediction score for each classified potential cyber-security threat, wherein the prediction score is determined based in part on the correlation score.

20. The system of claim 19 , wherein the system is further configured:

perform a mitigation action against the potential cyber-security threat, wherein the mitigation action is determined based on the prediction score and a security policy.

21. The system of claim 20 , wherein the mitigation action includes at least one of: blocking network traffic between at least one source and at least one destination, diverting network traffic, and generating alerts.

22. The system of claim 20 , further comprising: determining the mitigation action based on a cost for performing the mitigation.

23. The system of claim 19 , wherein a group of security events is any one of: a matched event and an advanced event, wherein a matched event is a security event matching at least one workflow rule, and wherein an advanced event is a matched event associated with an advanced attack caused by an identified cyber-security threat.

24. The system of claim 23 , wherein each of the set of correlation types determines how a potential cyber-security threat correlates to at least advanced events.

25. The system of claim 24 , wherein the overlap cause correlation type is determined when at least one advanced event in a chain of advanced events overlaps at least one matched event, wherein the potential cyber-security threat is a premature threat of an advanced attack.

26. The system of claim 25 , wherein events are considered overlapped when at least one of: application paths' attributes and seed events' attributes are the same.

27. The system of claim 24 , wherein the common descendant correlation type is determined when at least one advanced event is destined to a same destination as a potential cyber-security threat.

28. The system of claim 27 , wherein any one of the common ancestor correlation type and the overlap cause correlation type is determined when a cause-effect matched event overlaps a cause-effect advanced event, wherein a potential cyber-security threat leads to a destination designated in the cause-effect matched event.

29. The system of claim 28 , wherein the two events are considered overlapping when said two events originate from the same source.

30. The system of claim 23 , wherein each of the set of correlation types is any one of: a common ancestor correlation type, an overlap cause correlation type, an overlap cause-effect correlation type, and a common descendant correlation type.

31. The system of claim 30 , wherein the common ancestor correlation type is determined when at least one advanced event is originated from a same ancestor source as a potential cyber-security threat.

32. The system of claim 19 , wherein the system is further configured:

factor at least one of: a number of correlated events and a number of identified correlation types.

33. The system of claim 32 , wherein the system is further configured:

factor in addition to the correlation score at least one of: a type of an identified potential cyber-security threat, a risk level associated with the identified potential cyber-security threat, and at least one cause-and-effect attribute, thereby resulting with the prediction score.

34. The system of claim 19 , wherein each potential cyber-security attack is at least a multi-vector attack campaign.

35. The system of claim 19 , wherein the multi-vector attack campaign is any one of: an insider threat campaign, a personal data-leak campaign, a ransomware campaign, an intelligence gathering, a financial data-leak campaign, and a denial-of-service (DoS) attack campaign.