Method and system for implementing threat intelligence as a service
A method and system for implementing threat intelligence as a service in a cloud computing environment. Specifically, the disclosed method and system entail leveraging existing disaster recovery (DR) solutions to perform threat intelligence tests and identify known cyber security threats and/or anomalous activity instigated by unknown cyber security threats, if any, on system images backed up on the existing DR solution. In leveraging existing DR solutions, a threat intelligence service is integrated into the existing DR solution as an additional feature.
1. A method for implementing threat intelligence as a service, comprising:
for each production system of a set of production systems operatively connected to a disaster recovery platform (DRP):
receiving, by the DRP, a set of application granularity images (AGIs) for at least one application executing on the production system;
storing, for backup and archiving, the set of AGIs in a data repository;
obtaining a cyber protection configuration (CPC) associated with the production system;
selecting, based on the CPC, the set of AGIs from the data repository;
instantiating a restored image environment (RIE) in a cloud computing network;
configuring the RIE by restoring the set of AGIs in the RIE; and
creating an environment manager to probe the RIE in search for one selected from a group consisting of potential threat signatures (PTSs) and anomalous events.
2. The method of claim 1 , wherein the CPC comprises a set of parameters outlining at least one threat intelligence test, wherein the set of parameters specify at least the set of AGIs for the at least one application.
3. The method of claim 1 , further comprising:
for each RIE of a first set of RIEs:
identifying a PTS exhibited by the set of AGIs restored in the RIE;
matching the PTS to one known cyber threat signature of a set of known cyber threat signatures; and
issuing, in response to the matching, a PTS notification comprising at least the PTS.
4. The method of claim 3 , wherein the first set of RIEs is a subset of a second set of RIEs, wherein the second set of RIEs comprises one RIE for each production system of the set of production systems.
5. The method of claim 3 , further comprising:
for each PTS notification of a set of PTS notifications issued as a result of monitoring the first set of RIEs:
generating a threat intelligence report comprising at least the PTS disclosed in the PTS notification; and
transmitting the threat intelligence report to a recipient production system,
wherein the recipient production system is one production system in a subset of production systems of the set of production systems,
wherein each production system of the subset of production systems is associated with the set of AGIs restored in one RIE of the first set of RIEs.
6. The method of claim 3 , further comprising:
using a set of PTS notifications issued as a result of monitoring the first set of RIEs:
obtaining a first PTS enclosed in a first PTS notification of the set of PTS notifications;
obtaining a second PTS enclosed in a second PTS notification of the set of PTS notifications;
determining that the first PTS matches the second PTS;
generating, based on the determining, a threat intelligence report comprising at least the first PTS; and
transmitting the threat intelligence report to all production systems in the set of production systems.
7. The method of claim 1 , further comprising:
for each RIE of a first set of RIEs:
detecting an anomalous event exhibited by the set of AGIs restored in the RIE;
assessing the anomalous event to identify a cyber threat root; and
generating a cyber threat solution based at least in part on the cyber threat root.
8. The method of claim 7 , further comprising:
for each cyber threat solution of a set of cyber threat solutions generated as a result of monitoring the first set of RIEs:
generating a threat intelligence report comprising at least the cyber threat solution; and
transmitting the threat intelligence report to at least one production system of the set of production systems.
9. A disaster recovery platform (DRP), comprising:
a computer processor;
memory and a data repository coupled to the computer processor; and
a threat intelligence service (TIS) executing on the computer processor,
wherein the DRP, using the TIS at least in part, is programmed to:
for each production system of a set of production systems operatively connected to the DRP:
receive a set of application granularity images (AGIs) for at least one application executing on the production system;
store, for backup and archiving, the set of AGIs in the data repository;
obtain a cyber protection configuration (CPC) associated with the production system;
select, based on the CPC, the set of AGIs from the data repository;
instantiate a restored image environment (RIE) in a cloud computing network;
configure the RIE by restoring the set of AGIs in the RIE; and
create an environment manager to probe the RIE in search for one selected from a group consisting of potential threat signatures (PTSs) and anomalous events.
10. The DRP of claim 9 ,
wherein the TIS comprises a set of environment managers,
wherein the set of environment managers comprises the environment manager monitoring the RIE instantiated for each production system of the set of production systems.
11. The DRP of claim 9 , wherein the set of AGIs represents one selected from a group consisting of a computer process, an application comprising a plurality of computer processes, and a plurality of applications comprising a plurality of mutually exclusive sets of computer processes.
12. A non-transitory computer readable medium (CRM) comprising computer readable program code, which when executed by a computer processor residing on a disaster recovery platform (DRP), enables the DRP to:
for each production system of a set of production systems operatively connected to the DRP:
receive a set of application granularity images (AGIs) for at least one application executing on the production system;
store, for backup and archiving, the set of AGIs in a data repository;
obtain a cyber protection configuration (CPC) associated with the production system;
select, based on the CPC, the set of AGIs from the data repository;
instantiate a restored image environment (RIE) in a cloud computing network;
configure the RIE by restoring the set of AGIs in the RIE; and
create an environment manager to probe the RIE in search for one selected from a group consisting of potential threat signatures (PTSs) and anomalous events.
13. The non-transitory CRM of claim 12 , wherein the CPC comprises a set of parameters outlining at least one threat intelligence test, wherein the set of parameters specify at least the set of AGIs for the at least one application.
14. The non-transitory CRM of claim 12 , comprising computer readable program code, which when executed by the computer processor, further enables the DRP to:
for each RIE of a first set of RIEs:
identify a PTS exhibited by the set of AGIs restored in the RIE;
match the PTS to one known cyber threat signature of a set of known cyber threat signatures; and
issue, in response to the matching, a PTS notification comprising at least the PTS.
15. The non-transitory CRM of claim 14 , wherein the first set of RIEs is a subset of a second set of RIEs, wherein the second set of RIEs comprises one RIE for each production system of the set of production systems.
16. The non-transitory CRM of claim 14 , comprising computer readable program code, which when executed by the computer processor, further enables the DRP to:
for each PTS notification of a set of PTS notifications issued as a result of monitoring the first set of RIEs:
generate a threat intelligence report comprising at least the PTS disclosed in the PTS notification; and
transmit the threat intelligence report to a recipient production system,
wherein the recipient production system is one production system in a subset of production systems of the set of production systems,
wherein each production system of the subset of production systems is associated with the set of AGIs restored in one RIE of the first set of RIEs.
17. The non-transitory CRM of claim 14 , comprising computer readable program code, which when executed by the computer processor, further enables the DRP to:
using a set of PTS notifications issued as a result of monitoring the first set of RIEs:
obtain a first PTS enclosed in a first PTS notification of the set of PTS notifications;
obtain a second PTS enclosed in a second PTS notification of the set of PTS notifications;
determine that the first PTS matches the second PTS;
generate, based on the determining, a threat intelligence report comprising at least the first PTS; and
transmit the threat intelligence report to all production systems in the set of production systems.
18. The non-transitory CRM of claim 12 , comprising computer readable program code, which when executed by the computer processor, further enables the DRP to:
for each RIE of a first set of RIEs:
detect an anomalous event exhibited by the set of AGIs restored in the RIE;
assess the anomalous event to identify a cyber threat root; and
generate a cyber threat solution based at least in part on the cyber threat root.
19. The non-transitory CRM of claim 18 , comprising computer readable program code, which when executed by the computer processor, further enables the DRP to:
for each cyber threat solution of a set of cyber threat solutions generated as a result of monitoring the first set of RIEs:
generate a threat intelligence report comprising at least the cyber threat solution; and
transmit the threat intelligence report to at least one production system of the set of production systems.