Systems and methods for automated quantitative risk and threat calculation and remediation
A system described herein may provide a technique for identifying and remediating potential threat vectors in a system, such as containers or applications in a virtual or cloud computing environment. Attributes of potential threat vectors may be identified, and the potential threat vectors may be scored based on the attributes. Values or scores of individual attributes may be determined through machine learning or other suitable techniques. Scores exceeding a threshold may indicate that a remedial measure should be performed. A remedial measure may be identified using machine learning or other suitable techniques. After the remedial measure is performed, the threat vector may be scored again, and a machine learning model may be refined based on whether the remedial measure was successful.
1. A device, comprising:
one or more processors configured to:
receive attribute information for a plurality of containers in a virtualized environment;
identify, for each attribute associated with a particular container, of the plurality of containers, a value associated with the attribute;
generate, for each container of the plurality of containers, a score that is based on the respective values associated with the attributes of the each container;
identify that the generated score for the particular container exceeds a threshold;
identify a particular remedial action, out of a plurality of candidate remedial actions, to take based on identifying that the generated score exceeds the threshold;
recalculate the score for the particular container based on taking the particular remedial action;
determine that the recalculated score does not exceed the threshold; and
cause the identified remedial action to be performed, based on determining that the recalculated score does not exceed the threshold.
2. The device of claim 1 , wherein the attributes associated with the particular container are associated with a plurality of groups, wherein each attribute associated with the particular container is associated with a particular one of the groups, of the plurality of groups, wherein each group is associated with a different weight.
3. The device of claim 2 , wherein the score for the particular container is calculated based on:
the values of the attributes associated with the particular container, and
the weights associated with the groups, with which the attributes are associated.
4. The device of claim 1 , wherein the generated score and the recalculated scores indicate a measure of risk associated with the particular container.
5. The device of claim 1 , wherein identifying the particular remedial action includes:
identifying another container for which the same particular remedial action was previously taken;
performing a similarity analysis to identify that the other container and the particular container have a measure of similarity that exceeds a threshold measure of similarity; and
selecting the particular remedial action for the particular container based on identifying that the other container, for which the same particular remedial action was taken, and the particular container have the measure of similarity that exceeds the threshold measure of similarity.
6. The device of claim 1 , wherein the one or more processors are further configured to:
refine a machine learning model to indicate that the identified remedial action was selected based on the attributes associated with the particular container.
7. The device of claim 1 , wherein a particular attribute, associated with the particular container, includes an anti-affinity between the particular container and another container, wherein the device is further configured to:
identify that the particular container is installed on a same node as the other container for which the particular container has the anti-affinity,
wherein the score is generated further based on identifying that the particular container is installed on the same node as the other container for which the particular container has the anti-affinity.
8. A non-transitory computer-readable medium, storing a plurality of processor-executable instructions to:
receive attribute information for a plurality of containers in a virtualized environment;
identify, for each attribute associated with a particular container, of the plurality of containers, a value associated with the attribute;
generate, for each container of the plurality of containers, a score that is based on the respective values associated with the attributes of the each container;
identify that the generated score for the particular container exceeds a threshold;
identify a particular remedial action, out of a plurality of candidate remedial actions, to take based on identifying that the generated score exceeds the threshold;
recalculate the score for the particular container based on taking the particular remedial action;
determine that the recalculated score does not exceed the threshold; and
cause the identified remedial action to be performed, based on determining that the recalculated score does not exceed the threshold.
9. The non-transitory computer-readable medium of claim 8 , wherein the attributes associated with the particular container are associated with a plurality of groups, wherein each attribute associated with the particular container is associated with a particular one of the groups, of the plurality of groups, wherein each group is associated with a different weight.
10. The non-transitory computer-readable medium of claim 9 , wherein the score for the particular container is calculated based on:
the values of the attributes associated with the particular container, and
the weights associated with the groups, with which the attributes are associated.
11. The non-transitory computer-readable medium of claim 8 , wherein the generated score and the recalculated scores indicate a measure of risk associated with the particular container.
12. The non-transitory computer-readable medium of claim 8 , wherein identifying the particular remedial action includes:
identifying another container for which the same particular remedial action was previously taken; and
performing a similarity analysis to identify that the other container and the particular container have a measure of similarity that exceeds a threshold measure of similarity;
selecting the particular remedial action for the particular container based on identifying that the other container, for which the same particular remedial action was taken, and the particular container have the measure of similarity that exceeds the threshold measure of similarity.
13. The non-transitory computer-readable medium of claim 8 , wherein the plurality of processor-executable instructions further include processor-executable instructions to:
refine a machine learning model to indicate that the identified remedial action was selected based on the attributes associated with the particular container.
14. The non-transitory computer-readable medium of claim 8 , wherein a particular attribute, associated with the particular container, includes an anti-affinity between the particular container and another container, wherein the device is further configured to:
identify that the particular container is installed on a same node as the other container for which the particular container has the anti-affinity,
wherein the score is generated further based on identifying that the particular container is installed on the same node as the other container for which the particular container has the anti-affinity.
15. A method, comprising:
receiving attribute information for a plurality of containers in a virtualized environment;
identifying, for each attribute associated with a particular container, of the plurality of containers, a value associated with the attribute;
generating, for each container of the plurality of containers, a score that is based on the respective values associated with the attributes of the each container;
identifying that the generated score for the particular container exceeds a threshold;
identifying a particular remedial action, out of a plurality of candidate remedial actions, to take based on identifying that the generated score exceeds the threshold;
recalculating the score for the particular container based on taking the particular remedial action;
determining that the recalculated score does not exceed the threshold; and
causing the identified remedial action to be performed, based on determining that the recalculated score does not exceed the threshold.
16. The method of claim 15 , wherein the attributes associated with the particular container are associated with a plurality of groups, wherein each attribute associated with the particular container is associated with a particular one of the groups, of the plurality of groups, wherein each group is associated with a different weight, wherein the score for the particular container is calculated based on:
the values of the attributes associated with the particular container, and
the weights associated with the groups, with which the attributes are associated.
17. The method of claim 15 , wherein the generated score and the recalculated scores indicate a measure of risk associated with the particular container.
18. The method of claim 15 , wherein identifying the particular remedial action includes:
identifying another container for which the same particular remedial action was previously taken;
performing a similarity analysis to identify that the other container and the particular container have a measure of similarity that exceeds a threshold measure of similarity; and
selecting the particular remedial action for the particular container based on identifying that the other container, for which the same particular remedial action was taken, and the particular container have the measure of similarity that exceeds the threshold measure of similarity.
19. The method of claim 15 , further comprising:
refining a machine learning model to indicate that the identified remedial action was selected based on the attributes associated with the particular container.
20. The method of claim 15 , wherein a particular attribute, associated with the particular container, includes an anti-affinity between the particular container and another container, the method further comprising:
identifying that the particular container is installed on a same node as the other container for which the particular container has the anti-affinity,
wherein the score is generated further based on identifying that the particular container is installed on the same node as the other container for which the particular container has the anti-affinity.