Mitigating cyber-attacks by automatically coordinating responses from cyber-security tools

1. A system comprising:

a processing device; and

a memory device including instructions for a cyber-security engine, the instructions being executable by the processing device for causing the processing device to:

receive a plurality of software modules created by a plurality of sources, each software module of the plurality of software modules being for integrating a respective cyber-security tool among a plurality of cyber-security tools with the cyber-security engine;

configure the plurality of software modules for use with the cyber-security engine to enable the cyber-security engine to communicate with the plurality of cyber-security tools;

detect one or more events indicative of a cyber-attack against a computing environment by using the plurality of software modules to communicate with the plurality of cyber-security tools;

in response to detecting the one or more events indicative of a cyber-attack, determine a coordinated-response strategy involving cooperation among the plurality of cyber-security tools to mitigate the cyber-attack; and

transmit commands to the plurality of cyber-security tools, the commands being configured to cause the plurality of cyber-security tools to implement the coordinated-response strategy.

2. The system of claim 1 , wherein:

each source of the plurality of sources is a company that is different from the other sources in the plurality of sources;

the plurality of software modules are programmed in a common programming language; and

the memory device further includes instructions that are executable by the processing device for causing the processing device to receive the plurality of software modules by downloading the plurality of software modules from a centralized repository via the Internet.

3. The system of claim 1 , wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to determine the coordinated-response strategy by using a machine-learning model that is configured to analyze characteristics of the cyber-attack and select the coordinated-response strategy from among a plurality of coordinated-response strategies based on the characteristics of the cyber-attack.

4. The system of claim 3 , wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to:

determine that a first response-strategy was previously applied by a first cyber-security engine to mitigate the cyber-attack by communicating with the first cyber-security engine;

determine that a second response-strategy was previously applied by a second cyber-security engine to mitigate the cyber-attack by communicating with the second cyber-security engine;

determine that the first response-strategy is superior to the second response-strategy according to at least one predefined criterion; and

based on determining that the first response-strategy is superior to the second response-strategy, train the machine-learning model to select the first response-strategy as the coordinated-response strategy rather than the second response-strategy.

5. The system of claim 4 , wherein the first cyber-security engine is for protecting a first network, and the second cyber-security engine is for protecting a second network that is different from the first network.

6. The system of claim 3 , wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to train the machine-learning model by iteratively:

using the machine-learning model to analyze a particular cyber-attack and determine a candidate response-strategy for mitigating the particular cyber-attack;

displaying information about the candidate response-strategy to a user via a display device;

receiving user input indicating whether the candidate response-strategy is acceptable or unacceptable; and

configuring one or more parameters of the machine-learning model in response to the user input.

7. The system of claim 1 , wherein the plurality of cyber-security tools include a firewall and an intrusion detection system (IDS), and wherein each cyber-security tool in the plurality of cyber-security tools has an application programming interface (API) for enabling integration with the cyber-security engine via the plurality of software modules.

8. The system of claim 1 , wherein:

the plurality of cyber-security tools includes (i) a first cyber-security tool capable of performing a mitigation operation for at least partially mitigating the cyber-attack, and (ii) a second cyber-security tool capable of performing the mitigation operation; and

the memory device further includes instructions that are executable by the processing device for causing the processing device to determine the coordinated-response strategy by:

determining that the first cyber-security tool is capable of performing the mitigation operation in a superior manner to the second cyber-security tool according to a predefined criterion; and

in response to determining that the first cyber-security tool is capable of performing the mitigation operation in the super manner, selecting the first cyber-security tool for performing the mitigation operation as part of the coordinated-response strategy.

9. A method comprising:

receiving, by a processing device, a plurality of software modules created by a plurality of sources, each software module of the plurality of software modules being for integrating a respective cyber-security tool among a plurality of cyber-security tools with a cyber-security engine;

configuring, by the processing device, the plurality of software modules for use with the cyber-security engine to enable the cyber-security engine to communicate with the plurality of cyber-security tools;

detecting, by the processing device, one or more events indicative of a cyber-attack against a computing environment by using the the plurality of software modules to communicate with the plurality of cyber-security tools;

in response to detecting the one or more events indicative of a cyber-attack, determining, by the processing device, a coordinated-response strategy involving cooperation among the plurality of cyber-security tools to mitigate the cyber-attack; and

transmitting, by the processing device, commands to the plurality of cyber-security tools, the commands being configured to cause the plurality of cyber-security tools to implement the coordinated-response strategy.

10. The method of claim 9 , wherein:

each source of the plurality of sources is a company that is different from the other sources in the plurality of sources;

the plurality of software modules are programmed in a common programming language; and

further comprising receiving the plurality of software modules by downloading the plurality of software modules from a centralized repository via the Internet.

11. The method of claim 9 , further comprising determining the coordinated-response strategy by using a machine-learning model that is configured to analyze characteristics of the cyber-attack and select the coordinated-response strategy from among a plurality of coordinated-response strategies based on the characteristics of the cyber-attack.

12. The method of claim 9 , further comprising:

determining that a first response-strategy was previously applied by a first cyber-security engine to mitigate the cyber-attack by communicating with the first cyber-security engine;

determining that a second response-strategy was previously applied by a second cyber-security engine to mitigate the cyber-attack by communicating with the second cyber-security engine;

determining that the first response-strategy is superior to the second response-strategy according to at least one predefined criterion; and

based on determining that the first response-strategy is superior to the second response-strategy, training a machine-learning model to select the first response-strategy as the coordinated-response strategy rather than the second response-strategy.

13. The method of claim 12 , wherein the first cyber-security engine is for protecting a first network, and the second cyber-security engine is for protecting a second network that is different from the first network.

14. The method of claim 9 , wherein:

the plurality of cyber-security tools includes (i) a first cyber-security tool capable of performing a mitigation operation for at least partially mitigating the cyber-attack, and (ii) a second cyber-security tool capable of performing the mitigation operation; and

further comprising determining the coordinated-response strategy by:

determining that the first cyber-security tool is capable of performing the mitigation operation in a superior manner to the second cyber-security tool according to a predefined criterion; and

in response to determining that the first cyber-security tool is capable of performing the mitigation operation in the super manner, selecting the first cyber-security tool for performing the mitigation operation as part of the coordinated-response strategy.

15. A non-transitory computer-readable medium comprising program code that is executable by a processing device for causing the processing device to:

receive a plurality of software modules created by a plurality of sources, each software module of the plurality of software modules being for integrating a respective cyber-security tool among a plurality of cyber-security tools with a cyber-security engine;

configure the plurality of software modules for use with the cyber-security engine to enable the cyber-security engine to communicate with the plurality of cyber-security tools;

detect one or more events indicative of a cyber-attack against a computing environment by using the the plurality of software modules to communicate with the plurality of cyber-security tools;

in response to detecting the one or more events indicative of a cyber-attack, determine a coordinated-response strategy involving cooperation among the plurality of cyber-security tools to mitigate the cyber-attack; and

transmit commands to the plurality of cyber-security tools, the commands being configured to cause the plurality of cyber-security tools to implement the coordinated-response strategy.

16. The non-transitory computer-readable medium of claim 15 , wherein:

each source of the plurality of sources is a company that is different from the other sources in the plurality of sources;

the plurality of software modules are programmed in a common programming language; and

further comprising program code that is executable by the processing device for causing the processing device to receive the plurality of software modules by downloading the plurality of software modules from a centralized repository via the Internet.

17. The non-transitory computer-readable medium of claim 15 , further comprising program code that is executable by the processing device for causing the processing device to determine the coordinated-response strategy by using a machine-learning model that is configured to analyze characteristics of the cyber-attack and select the coordinated-response strategy from among a plurality of coordinated-response strategies based on the characteristics of the cyber-attack.

18. The non-transitory computer-readable medium of claim 15 , further comprising program code that is executable by the processing device for causing the processing device to:

determine that a first response-strategy was previously applied by a first cyber-security engine to mitigate the cyber-attack by communicating with the first cyber-security engine;

determine that a second response-strategy was previously applied by a second cyber-security engine to mitigate the cyber-attack by communicating with the second cyber-security engine;

determine that the first response-strategy is superior to the second response-strategy according to at least one predefined criterion; and

based on determining that the first response-strategy is superior to the second response-strategy, train a machine-learning model to select the first response-strategy as the coordinated-response strategy rather than the second response-strategy.

19. The non-transitory computer-readable medium of claim 18 , wherein the first cyber-security engine is for protecting a first network, and the second cyber-security engine is for protecting a second network that is different from the first network.

20. The non-transitory computer-readable medium of claim 15 , wherein:

the plurality of cyber-security tools includes (i) a first cyber-security tool capable of performing a mitigation operation for at least partially mitigating the cyber-attack, and (ii) a second cyber-security tool capable of performing the mitigation operation; and

further comprising program code that is executable by the processing device for causing the processing device to determine the coordinated-response strategy by:

determining that the first cyber-security tool is capable of performing the mitigation operation in a superior manner to the second cyber-security tool according to a predefined criterion; and

in response to determining that the first cyber-security tool is capable of performing the mitigation operation in the super manner, selecting the first cyber-security tool for performing the mitigation operation as part of the coordinated-response strategy.