System and method for a meta scan engine

1. A method comprising:

generating, via a computer and based on a plurality of threat conditions and commonalities among the plurality of threat conditions, a hierarchy for scanning of cyber threats, the hierarchy having lowest layers of threats which are connected to higher layers of threats by the commonalities;

scanning, via the computer, for all of the lowest layers of threats simultaneously; and

upon meeting a predetermined number of conditions during the scanning of the lowest layers, scanning at a higher layer of the hierarchy.

2. The method of claim 1 , wherein the predetermined number of conditions are Boolean conditions.

3. The method of claim 1 , wherein the predetermined number of conditions comprise a non-entirety portion of a total number of conditions for threats having a common higher layer within the hierarchy; and

wherein the scanning at the higher layer of the hierarchy identifies additional threat conditions.

4. The method of claim 1 , wherein the scanning for all of the lowest layers of threats simultaneously further comprises:

identifying, via the computer, data to be scanned for the cyber threats;

caching, via the computer, information about the data in a cache;

comparing, via the computer, the information within the cache to the plurality of threat conditions in an order determined by the hierarchy, to yield a comparison;

tracking, via the computer, detection of the commonalities within the data based on the comparison, to yield commonality detection; and

identifying, via the computer, found cyber threats based on the comparison and the commonality detection.

5. The method of claim 1 , wherein the scanning at a higher layer of the hierarchy further comprises:

identifying, via the computer, data to be scanned for the cyber threats;

caching, via the computer, information about the data in a cache;

deploying, via the computer, a plurality of search engines to analyze the information within the cache;

receiving search results from the plurality of search engines; and

identifying, via the computer, found cyber threats based on the search results according to the hierarchy.

6. The method of claim 1 , further comprising:

storing, via the computer, states associated with each threat condition, wherein the states associated with each threat condition persist throughout each respective scan iteration;

identifying, via the computer, a first threat analysis and a second threat analysis which are both required for a common parent node within the hierarchy; and

imposing, via the computer, a stop limit on the first threat analysis due to a distinct rate of detection between the first threat analysis and the second threat analysis, such that the first threat analysis is not performed until the second threat analysis is positive while the stop limit is in place.

7. The method of claim 1 , wherein the hierarchy is a directed acyclic graph.

8. The method of claim 1 , wherein the scanning for all of the lowest layers of threats simultaneously and the scanning at a higher layer of the hierarchy are performed on data passing through an Internet firewall.

9. The method of claim 1 , wherein the plurality of threat conditions for each cyber threat in the cyber threats are periodically updated.

10. A system, comprising:

a processor; and

a computer-readable storage medium having instructions stored which, when executed by the processor, cause the processor to perform operations comprising:

generating, based on a plurality of threat conditions and commonalities among the plurality of threat conditions, a hierarchy for scanning of cyber threats, the hierarchy having lowest layers of threats which are connected to higher layers of threats by the commonalities;

scanning for all of the lowest layers of threats simultaneously; and

upon meeting a predetermined number of conditions during the scanning of the lowest layers, scanning at a higher layer of the hierarchy.

11. The system of claim 10 , wherein the predetermined number of conditions are Boolean conditions.

12. The system of claim 10 , wherein the predetermined number of conditions comprise a non-entirety portion of a total number of conditions for threats having a common higher layer within the hierarchy; and

wherein the scanning at the higher layer of the hierarchy identifies additional threat conditions.

13. The system of claim 10 , wherein the scanning for all of the lowest layers of threats simultaneously further comprises:

identifying, via the computer, data to be scanned for the cyber threats;

caching, via the computer, information about the data in a cache;

comparing, via the computer, the information within the cache to the plurality of threat conditions in an order determined by the hierarchy, to yield a comparison;

tracking, via the computer, detection of the commonalities within the data based on the comparison, to yield commonality detection; and

identifying, via the computer, found cyber threats based on the comparison and the commonality detection.

14. The system of claim 10 , wherein the scanning at a higher layer of the hierarchy further comprises:

identifying, via the computer, data to be scanned for the cyber threats;

caching, via the computer, information about the data in a cache;

deploying, via the computer, a plurality of search engines to analyze the information within the cache;

receiving search results from the plurality of search engines; and

identifying, via the computer, found cyber threats based on the search results according to the hierarchy.

15. The system of claim 10 , the computer-readable storage medium having additional instructions stored which, when executed by the processor, cause the processor to perform operations comprising:

storing states associated with each threat condition, wherein the states associated with each threat condition persist throughout each respective scan iteration;

identifying a first threat analysis and a second threat analysis which are both required for a common parent node within the hierarchy; and

imposing a stop limit on the first threat analysis due to a distinct rate of detection between the first threat analysis and the second threat analysis, such that the first threat analysis is not performed until the second threat analysis is positive while the stop limit is in place.

16. The system of claim 10 , wherein the hierarchy is a directed acyclic graph.

17. The system of claim 10 , wherein the scanning for all of the lowest layers of threats simultaneously and the scanning at a higher layer of the hierarchy are performed on data passing through an Internet firewall.

18. The system of claim 10 , wherein the plurality of threat conditions for each cyber threat in the cyber threats are periodically updated.

19. A non-transitory computer-readable storage medium having instructions stored which, when executed by a computing device, cause the computing device to perform operations comprising:

generating, based on a plurality of threat conditions and commonalities among the plurality of threat conditions, a hierarchy for scanning of cyber threats, the hierarchy having lowest layers of threats which are connected to higher layers of threats by the commonalities;

scanning for all of the lowest layers of threats simultaneously; and

upon meeting a predetermined number of conditions during the scanning of the lowest layers, scanning at a higher layer of the hierarchy.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the predetermined number of conditions are Boolean conditions.