Creation and optimization of security applications for cyber threats detection, investigation and mitigation
A system and method for optimizing a defense model using available security capabilities are provided. The method includes obtaining a defense model and an optimal security application implementation associated with the defense model; evaluating available security capabilities deployed in an enterprise environment to determine a plurality of variant security applications implementing the defense model; determining a quality score for each of the plurality of the variant security applications; selecting, from the plurality of variant security applications, a variant security application having a highest quality score; and executing the selected variant security application.
1. A method for optimizing a defense model using available security capabilities, comprising:
obtaining a defense model, wherein the defense model defines a defense behavior with respect to an identified threat;
evaluating available security capabilities deployed in an enterprise environment to determine a plurality of variant security applications implementing the defense model;
determining a quality score for each variant security application of the plurality of variant security applications, the quality score reflecting a level of protection each variant security application offers against the identified threat;
selecting, from the plurality of variant security applications, a variant security application having a highest quality score; and
executing the selected variant security application to respond to the identified threat.
2. The method of claim 1 , further comprising: deploying the selected variant security application in the enterprise environment.
3. The method of claim 1 comprising obtaining a security application implementation of the defense model comprising a probability of success above a predetermined value, wherein the optimal security application implementation defines an optimal set of security engines.
4. The method of claim 3 , wherein each variant security application includes at least one of: a subset of the optimal set of security engines and alternative for security engines included the optimal set of the security engines.
5. The method of claim 1 , wherein the defense model is predefined and stored in a data repository.
6. The method of claim 4 , wherein evaluating the available security capabilities further comprises:
generating a list of currently available security engines and their respective quality scores.
7. The method of claim 6 , further comprising:
computing the quality score based on a performance score of each security engine defined in the variant security application.
8. The method of claim 7 , wherein the performance score is based on at least one of: an offline score determined by an attack database of a respective security product, a runtime score determined by attack logs provided by the respective security product, and a unified score determined by the offline score and the runtime score.
9. The method of claim 2 , wherein each variant security application maintains a logical structure of the optimal security application implementation of the defense model.
10. The method of claim 1 , wherein the selected variant security application provides a unified abstract representation that is agnostic to security products used for detection and mitigation of cyber threats.
11. The method of claim 1 , further comprising:
monitoring the available security capabilities periodically during the execution of the selected variant security application to identify any changes; and
optimizing the executed security application when changes in the available security capabilities are detected.
12. The method of claim 3 , wherein the optimal set of security engines are operable in an orchestration system deployed in the enterprise environment, wherein each security engine is associate with a security capability executed by a security product deployed in the enterprise environment.
13. The method of claim 12 , further comprising:
optimizing the defense model upon a failure of the security product.
14. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for optimizing a defense model using available security capabilities, the process comprising:
obtaining a defense model, wherein the defense model defines a defense behavior with respect to an identified threat;
evaluating available security capabilities deployed in an enterprise environment to determine a plurality of variant security applications implementing the defense model;
determining a quality score for each variant security application of the plurality of variant security applications, the quality score reflecting a level of protection each variant security application offers against the identified threat;
selecting, from the plurality of variant security applications, a variant security application having a highest quality score; and
executing the selected variant security application to respond to the identified threat.
15. A system for optimizing a defense model using available security capabilities, comprising:
a processing circuitry;
a memory coupled to the processing circuitry, the memory contains therein instructions that when executed by the processing circuitry configure the system to:
obtain a defense, wherein the defense model defines a defense behavior with respect to an identified threat;
evaluate available security capabilities deployed in an enterprise environment to determine a plurality of variant security applications implementing the defense model;
determine a quality score for each variant security application of the plurality of variant security applications, the quality score reflecting a minimum level of protection each variant security application offers against the identified threat;
select, from the plurality of variant security applications, a variant security application having a highest quality score; and
execute the selected variant security application to respond to the identified threat.
16. The system of claim 15 , wherein the system is further configured to:
deploy the selected variant security application in the enterprise environment.
17. The system of claim 15 comprising obtaining a security application implementation of the defense model comprising a probability of success above a predetermined value, wherein the optimal security application implementation defines an optimal set of security engines.
18. The system of claim 17 , wherein each variant security application includes at least one of: a subset of the optimal set of security engines and an alternative for security engines included the optimal set of the security engines.
19. The system of claim 18 , wherein the defense model is predefined and stored in a data repository.
20. The system of claim 18 , wherein the system is further configured to: generate a list of currently available security engines and their respective quality scores.
21. The system of claim 20 , wherein the system is further configured to:
compute a quality score based on a performance score of each security engine defined in the selected variant security application.
22. The system of claim 21 , wherein the performance score is based on at least one of: an offline score determined by an attack database of a respective security product, a runtime score determined by attack logs provided by the respective security product, and a unified score determined by the offline score and the runtime score.
23. The system of claim 16 , wherein each variant security application maintains a logical structure of the optimal security application implementation of the defense model.
24. The system of claim 15 , wherein the selected variant security application provides a unified abstract representation that is agnostic to security products used for detection and mitigation of cyber threats.
25. The system of claim 15 , wherein the system is further configured to:
monitor the available security capabilities periodically during the execution of the selected variant security application to identify any changes; and
optimize the selected variant security application when changes in the available security capabilities are detected.
26. The system of claim 18 , wherein the security engines are operable in an orchestration system deployed in the enterprise environment, wherein each security engine is associate with a security capability executed by a security product deployed in the enterprise environment.
27. The system of claim 26 , wherein the system is further configured to:
optimize the defense model upon a failure of a security product.