Automated security feed analysis for threat assessment
At least one security feed indicative of at least one security event that may impact or has impacted one or more assets associated with an organization is obtained. The at least one security feed is automatically classified as being relevant or not relevant. The at least one security feed is automatically ranked in response to the at least one security feed being classified as relevant. The ranking of the at least one security feed is presented to an entity to make an assessment of the security event.
1. A method comprising:
obtaining at least one security feed indicative of at least one security attack that has impacted one or more assets associated with an organization or presents an impact vulnerability to the one or more assets;
processing the at least one security feed by extracting one or more features of the at least one security feed to form one or more feature vectors;
automatically classifying the at least one security feed as being relevant or not relevant to the organization based on the one or more feature vectors, wherein classifying is performed by applying the one or more feature vectors to a classification algorithm;
automatically ranking the at least one security feed in response to the at least one security feed being classified as relevant;
presenting the ranking of the at least one security feed to an entity to make an assessment of the security attack to protect the organization from the at least one security attack; and
determining one or more actions based at least in part on the assessment of the security attack;
wherein the above steps are executed by at least one processing device comprising a processor operatively coupled to a memory.
2. The method of claim 1 , wherein the automated classifying step further comprises determining relevance based on a comparison between a representation of information of the one or more assets of the organization and the at least one security feed.
3. The method of claim 2 , wherein the representation of information of the one or more assets of the organization comprises an organizational network that represents value of each asset of the organization and relationships between assets.
4. The method of claim 2 , wherein the representation of information of the one or more assets of the organization comprises one or more information files that respectively correspond to the one or more assets of the organization.
5. The method of claim 2 , wherein the automated classifying step further comprises determining relevance based on one or more security feeds that preceded the at least one security feed in time.
6. The method of claim 5 , wherein the automated classifying step further comprises utilizing relevance classification of the one or more security feeds that preceded the at least one security feed to train a classification model used to classify the at least one security feed.
7. The method of claim 1 , wherein the automated ranking step further comprises computing a ranking score based on one or more security feeds that preceded the at least one security feed in time.
8. The method of claim 7 , wherein the automated ranking step further comprises utilizing rankings of the one or more security feeds that preceded the at least one security feed to train a ranking model used to rank the at least one security feed.
9. The method of claim 7 , wherein the automated ranking step further comprises computing the ranking score for the at least one security feed based on one or more values attributed to the one or more assets of the organization.
10. The method of claim 9 , wherein the one or more values attributed to the one or more assets of the organization are computed by one or more valuation algorithms.
11. The method of claim 10 , wherein at least one of the valuation algorithms computes correlation between two or more assets of the organization.
12. The method of claim 1 , wherein the one or more extracted features comprise metadata relating to the one or more assets.
13. The method of claim 1 , wherein the one or more extracted features comprise a standard measurement of vulnerability impact score.
14. The method of claim 1 , wherein at least a second security feed indicative of a second security attack that may impact or has impacted the one or more assets associated with the organization is obtained, and the automated classifying step and automated ranking step are performed on the second security feed.
15. The method of claim 14 , wherein the presenting step further comprises presenting the rankings of the at least one security feed and the second security feed in a ranked list to the entity to make an assessment of the security attack.
16. The method of claim 14 , wherein the at least one security feed and the second security feed are from different sources.
17. The method of claim 14 , wherein the at least one security attack and the second security attack are related to the same security incident.
18. A system comprising:
at least one processor, coupled to a memory, and configured to:
obtain at least one security feed indicative of at least one security attack that has impacted one or more assets associated with an organization or presents an impact vulnerability to the one or more assets;
process the at least one security feed by extracting one or more features of the at least one security feed to form one or more feature vectors;
automatically classify the at least one security feed as being relevant or not relevant to the organization based on the one or more feature vectors, wherein classifying is performed by applying the one or more feature vectors to a classification algorithm;
automatically rank the at least one security feed in response to the at least one security feed being classified as relevant;
present the ranking of the at least one security feed to an entity to make an assessment of the security attack to protect the organization from the at least one security attack; and
determine one or more actions based at least in part on the assessment of the security attack.
19. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device to:
obtain at least one security feed indicative of at least one security attack that has impacted one or more assets associated with an organization or presents an impact vulnerability to the one or more assets;
process the at least one security feed by extracting one or more features of the at least one security feed to form one or more feature vectors;
automatically classify the at least one security feed as being relevant or not relevant to the organization based on the one or more feature vectors, wherein classifying is performed by applying the one or more feature vectors to a classification algorithm;
automatically rank the at least one security feed in response to the at least one security feed being classified as relevant;
present the ranking of the at least one security feed to an entity to make an assessment of the security attack to protect the organization from the at least one security attack; and
determine one or more actions based at least in part on the assessment of the security attack.
20. The system of claim 18 , wherein the automated ranking step further comprises computing a ranking score based on one or more security feeds that preceded the at least one security feed in time.