Centralized threat intelligence
Systems and techniques for centralized threat intelligence are described herein. A connection may be established to a plurality of threat data sources. An anonymized set of threat data may be obtained by application of a set of privacy rules to the threat data from the plurality of threat data. A threat database may be populated with the anonymized set of threat data. A registration request may be received for a user of a device. A unique user identifier may be assigned for the user and a unique device identifier may be assigned for the device. A threat model may be generated based on a set of the characteristics from the threat database. A set of data access attributes may be received for a data access request. The data access request may be blocked based on an evaluation of the data access attributes using the threat model.
1. A system for centralized security threat detection comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
obtain a first entity privacy ruleset for a first threat data source of a first entity;
obtain an anonymized set of threat data from the first threat data source by processing threat data from the first threat data source by filtering confidential data from the threat data using a set of privacy rules from the first entity privacy ruleset;
populate a threat database with the anonymized set of threat data, wherein the threat data includes characteristics of security threats;
receive a registration request for a user of a device;
assign a unique user identifier for the user and a unique device identifier for the device;
generate a threat model for the unique user identifier and unique device identifier based on a set of the characteristics from the threat database that correspond to the user and the device;
receive a set of data access attributes for a data access request initiated with the unique user identifier and the unique device identifier for data from a data source of a second entity, the set of data access attributes anonymized using a second entity privacy ruleset for the second entity;
block the data access request based on an evaluation of the data access attributes using the threat model; and
update the threat database with the anonymized data access attributes.
2. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:
register the first threat data source with the threat database via a data exchange protocol that defines security controls and privacy rules to be included in the set of privacy rules used to obtain threat data from the first threat data source; and
import data elements from the first threat data source, wherein the instructions to populate the threat database include instructions to add the data elements to the threat database.
3. The system of claim 2 , the memory further comprising instructions that cause the at least one processor to perform operations to:
format the data elements by application of a set of data transformation rules to transform the data elements into a standardized data format.
4. The system of claim 3 , wherein the set of data transformation rules include a rule defining a format for at least one of an originating entity, a threat data type, a timestamp that indicates when a threat included in the data elements was detected, or a timestamp that indicates an indication of a first instance of the threat.
5. The system of claim 2 , the memory further comprising instructions that cause the at least one processor to perform operations to:
evaluate existent data in the threat database to determine matched sets between members of the existent data and members of the data elements; and
establish linked data sets for the matched sets, wherein the threat model is generated in part by evaluating the linked data sets.
6. The system of claim 1 , wherein the access request is a request for financial data from a financial institution.
7. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to:
transmit a challenge response to a device that initiated the data access request;
validate a response received in response to the challenge response;
upon validation of the response, complete the data access request; and
update the threat database with data elements obtained from the data access request and the response.
8. The system of claim 1 , the memory further comprising instructions that cause the at least one processor to perform operations to: transmit a message to a user that corresponds to the request that indicates that the data access request has been blocked.
9. At least one non-transitory machine-readable medium including instructions for centralized security threat detection that, when executed by at least one processor, cause the at least one processor to perform operations to:
obtain a first entity privacy ruleset for a first threat data source of a first entity;
obtain an anonymized set of threat data from a first threat data source by processing threat data from the first threat data source by filtering confidential data from the threat data using a set of privacy rules from the first entity privacy ruleset;
populate a threat database with the anonymized set of threat data, wherein the threat data includes characteristics of security threats;
receive a registration request for a user of a device;
assign a unique user identifier for the user and a unique device identifier for the device;
generate a threat model for the unique user identifier and unique device identifier based on a set of the characteristics from the threat database that correspond to the user and the device;
receive a set of data access attributes for a data access request initiated with the unique user identifier and the unique device identifier for data from a data source of a second entity, the set of data access attributes anonymized using a second entity privacy ruleset for the second entity;
block the data access request based on an evaluation of the data access attributes using the threat model; and
update the threat database with the anonymized data access attributes.
10. The at least one non-transitory machine-readable medium of claim 9 , further comprising instructions that cause the at least one processor to perform operations to:
register the first threat data source with the threat database via a data exchange protocol that defines security controls and privacy rules to be included in the set of privacy rules used to obtain threat data from the first threat data source; and
import data elements from the first threat data source, wherein the instructions to populate the threat database include instructions to add the data elements to the threat database.
11. The at least one non-transitory machine-readable medium of claim 10 , further comprising instructions that cause the at least one processor to perform operations to:
format the data elements by application of a set of data transformation rules to transform the data elements into a standardized data format.
12. The at least one non-transitory machine-readable medium of claim 11 , wherein the set of data transformation rules include a rule defining a format for at least one of an originating entity, a threat data type, a timestamp that indicates when a threat included in the data elements was detected, and a timestamp that indicates an indication of a first instance of the threat.
13. The at least one non-transitory machine-readable medium of claim 10 , further comprising instructions that cause the at least one processor to perform operations to:
evaluate existent data in the threat database to determine matched sets between members of the existent data and members of the data elements; and
establish linked data sets for the matched sets, wherein the threat model is generated in part by evaluating the linked data sets.
14. The at least one non-transitory machine-readable medium of claim 9 , wherein the access request is a request for financial data from a financial institution.
15. The at least one non-transitory machine-readable medium of claim 9 , further comprising instructions that cause the at least one processor to perform operations to:
transmit a challenge response to a device that initiated the data access request; and
validate a response received in response to the challenge response;
upon validation of the response, complete the data access request; and
update the threat databased with data elements obtained from the data access request and the response.
16. The at least one non-transitory machine-readable medium of claim 9 , further comprising instructions that cause the at least one processor to perform operations to transmit a message to a user that corresponds to the request that indicates that the data access request has been blocked.
17. A method for centralized security threat detection comprising:
obtaining a first entity privacy ruleset for a first threat data source of a first entity;
obtaining an anonymized set of threat data from a first threat data source by processing threat data from the first threat data source by filtering confidential data from the threat data using a set of privacy rules from the first entity privacy ruleset;
populating a threat database with the anonymized set of threat data, wherein the threat data includes characteristics of security threats;
receiving a registration request for a user of a device;
assigning a unique user identifier for the user and unique device identifier for the device;
generating a threat model for the unique user identifier and a unique device identifier using a set of the characteristics from the threat database that correspond to the user and the device;
receiving a set of data access attributes for a data access request initiated using the unique user identifier and the unique device identifier for data from a data source of a second entity the set of data access attributes anonymized using a second entity privacy ruleset for the second entity;
blocking the data access request based on an evaluation of the data access attributes using the threat model; and
updating the threat database with the anonymized data access attributes.
18. The method of claim 17 , further comprising:
registering the first threat data source with the threat database via a data exchange protocol that defines security controls and privacy rules to be included in the set of privacy rules for obtaining threat data from the first threat data source; and
importing data elements from the first threat data source, wherein populating the threat database includes adding the data elements to the threat database.
19. The method of claim 18 , further comprising:
formatting the data elements using a set of data transformation rules to transform the data elements into a standardized data format.
20. The method of claim 19 , wherein the set of data transformation rules include a rule defining a format for at least one of an originating entity, a threat data type, a timestamp that indicates when a threat included in the data elements was detected, and a timestamp that indicates an indication of a first instance of the threat.
21. The method of claim 18 , further comprising:
evaluating existing data in the threat database to determine matched sets between members of the existing data and members of the data elements; and
establishing linked data sets for the matched sets, wherein the threat model is generated in part by evaluating the linked data sets.
22. The method of claim 17 , wherein the access request is a request for financial data from a financial institution.
23. The method of claim 17 , further comprising:
transmitting a challenge response to a device initiating the data access request; and
validating a response received in response to the challenge response;
upon validation of the response, completing the data access request; and
updating the threat databased with data elements obtained from the data access request and the response.
24. The method of claim 17 , further comprising transmitting a message to a user corresponding to the request indicating that the data access request has been blocked.