Systems and methods for detecting and preventing cyber-threats
A system ( 100 ) for detecting and preventing cyber-threats is disclosed. The system ( 100 ) can include an online-analytical-processing (OLAP) resource ( 102 ) coupled to a data mining engine ( 104 ), a reporting resource ( 106 ) and a processor ( 108 ). The processor ( 108 ) can run instructions stored within an extract-transform-load (ETL) module ( 112 ). The ETL module ( 112 ) can enable the processor ( 108 ) to extract one or more data tuples various data sources ( 110 ). The ETL module ( 112 ) can enable the processor to transform the extracted tuple(s).
1. A system for detecting, evaluating and preventing cyber-threats, the system comprising:
at least one online-analytical-processing (OLAP) resource;
at least one cloud-based data mining engine coupled to the OLAP resource;
at least one reporting resource coupled to the OLAP resource; and
at least one processor coupled to the OLAP resource and coupled to at least one data source, the processor having at least one extract-transform-load (ETL) module associated therewith, the ETL module configured, upon execution by the at least one processor, to:
extract at least one data tuple from the data source;
transform the data tuple, wherein transforming the data tuple comprises normalizing the data tuple according to a predetermined policy and removing sensitive information from the at least one data tuple; and
load the transformed data tuple (TDT) to the OLAP resource, wherein the OLAP resource is configured to:
store the loaded TDT,
analyze the loaded TDT with reference to data acquired by the data mining engine and with reference to at least one previously stored TDT according to at least one predetermined algorithm wherein at least one measure of similarity between the loaded TDT and the previously stored TDT is a factor, the predetermined algorithm including a reliability score associated with the data source from which the TDT was extracted,
assign at least one threat score to the data source from which the TDT was extracted, according to the predetermined algorithm, and
upload the threat score to the at least one reporting resource; and
wherein the reporting resource is configured to collate and store the threat score for subsequent retrieval.
2. The system of claim 1 , wherein the data mining engine is coupled to an external network.
3. The system of claim 1 , wherein the ETL module is configured for interoperability with at least one firewall.
4. The system of claim 1 , wherein the sensitive information is stored locally to the data source.
5. The system of claim 1 , where the OLAP resource resides within a distributed network.
6. The system of claim 1 , wherein the OLAP resource is hosted by at least one web server.
7. The system of claim 1 , wherein the data source is assigned a unique identifier (ID), thereby making the data source anonymous with respect to at least one device which is external to the data source.
8. The system of claim 7 , wherein the unique ID is randomly assigned by an encryption algorithm.
9. The system of claim 1 , wherein the system utilizes a Domain Name System-modeled protocol to manage a hierarchical system of servers hosting the at least one data source, thereby enabling the system to operate in real-time or in near real-time.
10. A method of detecting, evaluating and preventing cyber-threats, the method comprising:
extracting, by at least one processor running at least one extract-transform-load (ETL) module, at least one data tuple from at least one data source;
transforming the data tuple, wherein transforming the data tuple comprises normalizing the data tuple according to a predetermined policy and removing sensitive information from the data tuple;
loading the transformed data tuple (TDT) to at least one OLAP resource;
storing the loaded TDT;
analyzing the loaded TDT with reference to data acquired by at least one cloud-based data mining engine and with reference to at least one previously stored TDT, according to at least one predetermined algorithm in which at least one measure of similarity between the loaded TDT and the previously stored TDT is a factor, the predetermined algorithm including a reliability score associated with the data source from which the TDT was extracted;
assigning at least one threat score to the data source from which the TDT was extracted, according to the predetermined algorithm; and
uploading the threat score to at least one reporting resource,
wherein the reporting resource is configured to collate and store the threat score for subsequent retrieval.
11. The method of claim 10 , wherein the data mining engine is coupled to an external network.
12. The method of claim 10 , wherein the ETL module is configured for interoperability with at least one firewall.
13. The method of claim 10 , wherein the sensitive information is stored locally to the data source.
14. The method of claim 10 , where the OLAP resource resides within a distributed network.
15. The method of claim 10 , wherein the OLAP resource is hosted by at least one web server.
16. The method of claim 10 , wherein the data source is assigned a unique identifier (ID), thereby making the data source anonymous with respect to at least one device which is external to the data source.
17. The method of claim 16 , wherein the unique ID is randomly assigned by an encryption algorithm.
18. The method of claim 10 , wherein the method utilizes a Domain Name System-modeled protocol to manage a hierarchical system of servers hosting the at least one data source, thereby enabling the method to operate in real-time or in near real-time.