Vulnerability profiling based on time series analysis of data streams
Various systems and methods are described for correlating technology choices with the risk of system vulnerabilities. A system captures and quantifies both observations of technology choices as well as the outputs certain outputs of internal choices and processes across a number of different organizations. A Bayesian estimate of vulnerability is imputed from the choices and observed use of vulnerable technology, further segmented by business type, revenue, and size. Differences between the observation of a particular organization and Bayesian expected value are measured and converted to vulnerability score, the vulnerability score embodying a point-in-time and longitudinal measure of organizational performance, including the likelihood of future compromise due to software vulnerabilities. The vulnerability score can then be further used to price risk, for example in a cyber insurance context.
1. A system for detecting and quantifying relative system vulnerabilities, the system comprising:
a domain, the domain comprising a plurality of information processing systems under common business control, each information processing system including a processor and a memory, an operating system executing on the processor, wherein the information processing system is coupled to at least one storage, the at least one storage including a plurality of files, the plurality of files including at least one application, the application including a file comprising a set of processor-executable instructions, wherein the operating system causes the application file to be loaded and the processor-executable instructions executed by the processor, the application file providing at least one network-visible interface;
a plurality of monitoring probes associated with the plurality of information processing systems, wherein each information processing system is associated with at least one monitoring probe; each monitoring probe interacting with one of the operating system and the application-provided network-visible interface, wherein each monitoring probe records an event observation and an associated timestamp;
a first time series accumulator receiving the plurality of event observations and time stamps and correlating them according to their time of occurrence;
an evaluator, the evaluator including:
a frequency domain transformer operable to take set of time-correlated event observations and represent them as an event feature matrix, each correlated event type being represented by a first dimension in the matrix and the occurrence information being represented by a second dimension in the matrix;
a matrix correlator operable to align a set of feature matrices according to one or more shared dimensions;
a multidimensional mapping function associating a first set of input feature matrices output from the matrix correlator with an output feature matrix;
wherein the output feature matrix represents a relative probability of system disruption due to a vulnerability on one or more of the plurality of information processing systems.
2. The system of claim 1 , wherein the time series accumulator stores information associated with a plurality of domains.
3. The system of claim 2 , further comprising a vulnerability information input stream, the vulnerability information input stream including a vulnerable technology identifier corresponding to one of an operating system or an application and a time index.
4. The system of claim 3 , wherein at least one event observation correlates the use of an operating system or an application used by at least one information processing system with a vulnerable technology identified in the vulnerability information input stream.
5. The system of claim 4 , wherein the use of an identified vulnerable technology on at least one information processing system in a domain is correlated with a change in the relative probability of system disruption.
6. The system of claim 4 , wherein the time between an event observation recording the use of a vulnerable technology and an event observation recording the vulnerable technology no longer being used is correlated with a change in the relative probability of system disruption.
7. The system of claim 3 , wherein the relative probability of vulnerabilities for a particular technology as measured from the rate of technology-specific vulnerabilities listed in the vulnerability information input stream is correlated with changes in the relative probability of system disruption for a domain using the same particular technology.
8. The system of claim 3 , further comprising a domain information stream identifying business characteristics of the domain, the business characteristics including one of a number of employees, a business type identifier, and a revenue measurement, and wherein the relative probability of system is correlated with at least one business characteristic.
9. The system of claim 8 , wherein the plurality of domains are divided by at least one business characteristic, and wherein the average probability of system disruption is computed within each division, and wherein the probability of use of each operating system and application is computed within each division.
10. The system of claim 9 , wherein differences in the observed use of operating systems and applications within a particular domain is compared with the probability of use of each operating system and applications across the division to which the domain pertains, and the difference in observed use of operating systems and applications versus the expected use of operating systems and applications is correlated with differences in the relative probability of system disruption for the particular domain.
11. The system of claim 1 , wherein the evaluator includes a multi-level convolutional neural network.