Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: establishing connectivity with a plurality of security-relevant subsystems within a computing platform; obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets.
1. A computer-implemented method, executed on a computing device, comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query concerning the plurality of security-relevant subsystems;
parsing the unified query to define a plurality of queries for at least a portion of each of the security-relevant subsystems;
executing the plurality of queries on the respective security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, based upon, at least in part, the plurality of queries, thus defining a plurality of security-relevant information sets;
processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets, wherein processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets includes:
utilizing a decision tree based, at least in part, upon one or more previously-acquired security-relevant information sets; and
defining an initial probabilistic model based upon, at least in part:
the plurality of security-relevant information sets, and
one or more user-specified probabilistic model variables;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified, wherein combining the plurality of security-relevant information sets to form the aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified includes homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set;
enabling third-party access to the aggregated security-relevant information set; and
generating a security profile based, at least in part, upon the aggregated security-relevant information set for the computing platform.
2. The computer-implemented method of claim 1 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
3. The computer-implemented method of claim 1 further comprising:
enabling third-party searching of the aggregated security-relevant information set.
4. The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
5. The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
6. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
7. A computer program product comprising a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query concerning the plurality of security-relevant subsystems;
parsing the unified query to define a plurality of queries for at least a portion of each of the security-relevant subsystems;
executing the plurality of queries on the respective security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, based upon, at least in part, the plurality of queries, thus defining a plurality of security-relevant information sets;
processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets, wherein processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets includes:
utilizing a decision tree based, at least in part, upon one or more previously-acquired security-relevant information sets; and
defining an initial probabilistic model based upon, at least in part:
the plurality of security-relevant information sets, and
one or more user-specified probabilistic model variables;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified, wherein combining the plurality of security-relevant information sets to form the aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified includes homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set;
enabling third-party access to the aggregated security-relevant information set; and
generating a security profile based, at least in part, upon the aggregated security-relevant information set for the computing platform.
8. The computer program product of claim 7 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
9. The computer program product of claim 7 further comprising:
enabling third-party searching of the aggregated security-relevant information set.
10. The computer program product of claim 7 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
11. The computer program product of claim 7 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
12. The computer program product of claim 7 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
13. A computing system including a processor and memory configured to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query concerning the plurality of security-relevant subsystems;
parsing the unified query to define a plurality of queries for at least a portion of each of the security-relevant subsystems;
executing the plurality of queries on the respective security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, based upon, at least in part, the plurality of queries, thus defining a plurality of security-relevant information sets;
processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets, wherein processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets includes:
utilizing a decision tree based, at least in part, upon one or more previously-acquired security-relevant information sets; and
defining an initial probabilistic model based upon, at least in part:
the plurality of security-relevant information sets, and
one or more user-specified probabilistic model variables;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified, wherein combining the plurality of security-relevant information sets to form the aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified includes homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set;
enabling third-party access to the aggregated security-relevant information set; and
generating a security profile based, at least in part, upon the aggregated security-relevant information set for the computing platform.
14. The computing system of claim 13 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
15. The computing system of claim 13 further comprising:
enabling third-party searching of the aggregated security-relevant information set.
16. The computing system of claim 13 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
17. The computing system of claim 13 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
18. The computing system of claim 13 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.