Platform and method for retroactive reclassification employing a cybersecurity-based global data store
A system for detecting artifacts associated with a cyber-attack features a cybersecurity intelligence hub remotely located from and communicatively coupled to one or more network devices via a network. The hub includes a data store and retroactive reclassification logic. The data store includes stored meta-information associated with each prior evaluated artifact of a plurality of prior evaluated artifacts. Each meta-information associated with a prior evaluated artifact of the plurality of prior evaluated artifacts includes a verdict classifying the prior evaluated artifact as a malicious classification or a benign classification. The retroactive reclassification logic is configured to analyze the stored meta-information associated with the prior evaluated artifact and either (a) identify whether the verdict associated with the prior evaluated artifact is in conflict with trusted cybersecurity intelligence or (b) identify inconsistent verdicts for the same prior evaluated artifact.
1. A system for detecting artifacts associated with a cyber-attack, comprising:
a first network device corresponding to physical electronic device featuring network connection functionality; and
a second network device remotely located from and communicatively coupled over a network to the first network device, the second network device comprises
a data store including meta-information associated with each prior evaluated artifact of a plurality of prior evaluated artifacts, wherein stored meta-information associated with a prior evaluated artifact of the plurality of prior evaluated artifacts corresponds to meta-information associated with a previously analyzed object and includes a verdict classifying the prior evaluated artifact as malicious or benign, and
retroactive reclassification logic being configured to analyze the stored meta-information associated with the prior evaluated artifact to identify inconsistent verdicts for the same prior evaluated artifact, wherein
in response to identifying inconsistent verdicts associated with the prior evaluated artifact, re-classifying the verdict associated with the prior evaluated artifact with a selected verdict determined to be a correct classification for the prior evaluated artifact by at least conducting an analysis of the stored meta-information associated with each of the inconsistent verdicts and determining differences that could have given rise to the inconsistent verdicts, including (i) an operating environment utilized in assigning the verdict to the prior evaluated artifact, (ii) characteristics of the prior evaluated artifact, (iii) type of analysis conducted to render the verdict, and (iv) source of the prior evaluated artifact, and
conducting operations for notifying a customer associated with the first network device supplying at least a portion of the stored meta-information associated with the prior evaluated artifact that the verdict associated with the prior evaluated artifact could be incorrect.
2. The system of claim 1 , wherein the retroactive reclassification logic of the second network device operates as a plug-in software module in communication with analytics logic deployed within the second network device, the analytics logic being configured to process and return one or more response messages to a request message operating as a query to via an administrative portal or a customer portal.
3. The system of claim 1 , wherein the retroactive reclassification logic of the second network device being further configured to analyze the stored meta-information associated with the prior evaluated artifact and identify whether the verdict associated with the prior evaluated artifact is in conflict with trusted cybersecurity intelligence by at least identifying the stored meta-information includes a source address of a malicious website as detected by the trusted cybersecurity intelligence.
4. The system of claim 1 , wherein the retroactive reclassification logic of the second network device being configured to conduct an analysis of the stored meta-information associated with the inconsistent verdicts for the same prior evaluated artifact by at least analyzing differences between an operating environment utilized in assigning a first verdict of the same prior evaluated artifact and an operating environment utilized in assigning a second verdict to the same prior evaluated artifact differing from the first verdict.
5. The system of claim 1 , wherein the retroactive reclassification logic of the second network device being configured to conduct an analysis of the stored meta-information associated with the inconsistent verdicts for the same prior evaluated artifact by at least analyzing differences between a type of the cybersecurity analysis conducted to render the first verdict and a type of cybersecurity analysis conducted to render the second verdict.
6. The system of claim 1 , wherein the retroactive reclassification logic of the second network device being configured to conduct an analysis of the stored meta-information associated with the inconsistent verdicts for the same prior evaluated artifact by at least analyzing differences between a source of the prior evaluated artifact associated with the first verdict and a source of the prior evaluated artifact associated with the second verdict.
7. The system of claim 1 , wherein the retroactive reclassification logic of the second network device being configured to tag one or more of the inconsistent verdicts that are determined to correspond to one or more incorrect verdicts on subsequent cybersecurity analyses of the stored meta-information associated with the inconsistent verdicts.
8. The system of claim 7 , wherein the second network device further comprises a reclassification notification plug-in, the reclassification notification plug-in to notify affected customers pertaining to the one or more incorrect verdicts.
9. The system of claim 7 , wherein the second network device further comprises a reclassification notification plug-in, the reclassification notification plug-in is configured to retain tags associated with the one or more incorrect verdicts and notifies the customer of the one or more incorrect verdicts pertaining to the customer in response to a message initiated by the customer via a portal.
10. The system of claim 1 , wherein the retroactive reclassification logic of the second network device being invoked in response to a triggering event, the triggering event includes a scheduled event that is conducted internally within the second network device.
11. A cybersecurity intelligence hub configured for network connectivity to a plurality of cybersecurity sensors to detect whether an artifact is associated with a cyber-attack without execution of the artifact, comprising:
a communication interface;
a hardware processor communicatively coupled to the communication interface;
a global data store communicatively coupled to the hardware processor, the global data store comprises meta-information associated with each prior evaluated artifact of a plurality of prior evaluated artifacts, wherein stored meta-information associated with a prior evaluated artifact of the plurality of prior evaluated artifacts corresponds to meta-information associated with a previously analyzed object and includes a verdict classifying the prior evaluated artifact as malicious or benign;
a memory communicatively coupled to the hardware processor, the memory including a data management and analytics engine including at least
a retroactive reclassification logic being configured to analyze the stored meta-information associated with the prior evaluated artifact to (a) determine inconsistent verdicts for the same prior evaluated artifact, and (b) in response to at least identifying the inconsistent verdicts for the same prior evaluated artifact, re-classify the verdict associated with the prior evaluated artifact with a selected verdict determined to be a correct classification for the prior evaluated artifact by at least conducting an analysis of the stored meta-information associated with each of the inconsistent verdicts and determining differences that could have given rise to the inconsistent verdicts, including (i) an operating environment utilized in assigning the verdict to the prior evaluated artifact, (ii) characteristics of the prior evaluated artifact, (iii) type of analysis conducted to render the verdict, and (iv) source of the prior evaluated artifact, and
reclassification notification logic configured to conduct operations for notifying a customer associated with a first network device supplying at least a portion of the stored meta-information associated with the prior evaluated artifact that the verdict associated with the prior evaluated artifact could be incorrect.
12. The cybersecurity intelligence hub of claim 11 further comprising analytics logic communicatively coupled to the retroactive reclassification logic, wherein the retroactive reclassification logic operates as a plug-in software module in communication with the analytics logic being configured to process and return one or more response messages to a request message operating as a query to via an administrative portal or a customer portal operating as the communication interface.
13. The cybersecurity intelligence hub of claim 11 , wherein the retroactive reclassification logic being configured to identify whether the verdict associated with the prior evaluated artifact is in conflict with trusted cybersecurity intelligence including identifying the stored meta-information includes a source address of a malicious website as detected by the trusted cybersecurity intelligence.
14. The cybersecurity intelligence hub of claim 11 , wherein the retroactive reclassification logic being configured to conduct an analysis of the stored meta-information associated with the inconsistent verdicts for the same prior evaluated artifact by at least analyzing differences in an operating environment utilized in assigning a first verdict of the same prior evaluated artifact and an operating environment utilized in assigning a second verdict to the same prior evaluated artifact differing from the first verdict.
15. The cybersecurity intelligence hub of claim 11 , wherein the retroactive reclassification logic being configured to conduct an analysis of the stored meta-information associated with the inconsistent verdicts for the same prior evaluated artifact by at least analyzing differences between either (i) a type of the cybersecurity analysis conducted to render the first verdict and a type of cybersecurity analysis conducted to render the second verdict or (ii) a source of the prior evaluated artifact associated with the first verdict and a source of the prior evaluated artifact associated with the second verdict.
16. The cybersecurity intelligence hub of claim 11 , wherein the retroactive reclassification logic being further configured to analyze the stored meta-information associated with the prior evaluated artifact to determine whether the verdict associated with the prior evaluated artifact is in conflict with trusted cybersecurity intelligence.
17. The cybersecurity intelligence hub of claim 11 , wherein the retroactive reclassification logic being configured to tag one or more of the inconsistent verdicts that are determined to correspond to one or more incorrect verdicts on subsequent cybersecurity analyses of the stored meta-information associated with the inconsistent verdicts.
18. The cybersecurity intelligence hub of claim 17 , wherein the reclassification notification logic operates as a plug-in and is configured to notify affected customers pertaining to the one or more incorrect verdicts.
19. The cybersecurity intelligence hub of claim 17 , wherein the reclassification notification logic operates as a plug-in and is configured to retain tags associated with the one or more incorrect verdicts and notify a customer of the one or more incorrect verdicts pertaining to the customer in response to a message initiated by the customer via a portal.
20. The cybersecurity intelligence hub of claim 11 , wherein the retroactive reclassification logic being invoked in response to a triggering event, the triggering event includes a scheduled event that is conducted internally within cybersecurity intelligence hub.
21. A computerized method for detecting artifacts associated with a cyber-attack, comprising:
storing meta-information associated with each prior evaluated artifact of a plurality of prior evaluated artifacts received from a plurality of cybersecurity intelligence sources located remotely from each other, each meta-information associated with a prior evaluated artifact of the plurality of prior evaluated artifacts includes a verdict classifying the prior evaluated artifact, the verdict being one of a plurality of classifications including a malicious classification or a benign classification;
analyzing the stored meta-information associated with the prior evaluated artifact to identify inconsistent verdicts for the prior evaluated artifact;
in response to identifying inconsistent verdicts associated with the prior evaluated artifact, re-classifying the verdict associated with the prior evaluated artifact with a selected verdict determined to be a correct classification for the prior evaluated artifact by at least conducting an analysis of the stored meta-information associated with each of the inconsistent verdicts and determining differences that could have given rise to the inconsistent verdicts, including (i) an operating environment utilized in assigning the verdict to the prior evaluated artifact, (ii) characteristics of the prior evaluated artifact, (iii) type of analysis conducted to render the verdict, and (iv) source of the prior evaluated artifact; and
conducting operations for notifying a customer associated with a network device supplying at least a portion of the stored meta-information associated with the prior evaluated artifact that the verdict associated with the prior evaluated artifact could be incorrect.
22. A system comprising:
a data store being a non-transitory storage medium including meta-information associated with each prior evaluated artifact of a plurality of prior evaluated artifacts, wherein stored meta-information associated with a prior evaluated artifact of the plurality of prior evaluated artifacts corresponds to meta-information associated with a previously analyzed object and includes a verdict classifying the prior evaluated artifact as malicious or benign,
a retroactive reclassification logic stored in the non-transitory storage medium, the retroactive reclassification logic being configured to analyze the stored meta-information associated with the prior evaluated artifact to (a) determine inconsistent verdicts for the same prior evaluated artifact, and (b) in response to at least identifying the inconsistent verdicts for the same prior evaluated artifact, re-classify the verdict associated with the prior evaluated artifact with a selected verdict determined to be a correct classification for the prior evaluated artifact by at least conducting an analysis of the stored meta-information associated with each of the inconsistent verdicts and determining differences that could have given rise to the inconsistent verdicts, including (i) an operating environment utilized in assigning the verdict to the prior evaluated artifact, (ii) characteristics of the prior evaluated artifact, (iii) type of analysis conducted to render the verdict, and (iv) source of the prior evaluated artifact, and
reclassification notification logic configured to conduct operations for notifying a customer associated with a first network device supplying at least a portion of the stored meta-information associated with the prior evaluated artifact that the verdict associated with the prior evaluated artifact could be incorrect.