System for component-level threat assessment in a computing environment
Systems, computer program products, and methods are described herein for component-level threat assessment in a computing environment. The present disclosure is configured to capture state information associated with a computing environment; determine correlation measures for the components in the computing environment based on at least the state information; determine threat vectors associated with the components; determine mitigation protocols to be implemented on the components in response to an incidence of the threat vectors on the components; determine a first sequence in which the mitigation protocols are to be implemented based on at least the correlation measures for the components; and implement the mitigation protocols on the components in the first sequence to reduce a propagation effect of the threat vectors across the computing environment.
1 . A system for component-level threat assessment in a computing environment, the system comprising:
a processing device;
a non-transitory storage device containing instructions when executed by the processing device, causes the processing device to:
capture state information associated with a computing environment, wherein the computing environment comprises components, wherein each component is associated with component-level information, wherein the component-level information comprises device characteristics, data usage telemetry, operational statistics, information associated with applications stored thereon, and historical threat vector assessment;
determine correlation measures for the components based on at least the state information, wherein the correlation measures quantify a level of dependency between the components;
determine threat vectors associated with the components;
determine mitigation protocols to be implemented on the components in response to an incidence of the threat vectors on the components;
determine a first sequence in which the mitigation protocols are to be implemented based on at least the correlation measures for the components; and
implement the mitigation protocols on the components in the first sequence to reduce a propagation effect of the threat vectors across the computing environment.
2 . The system of claim 1 , wherein executing the instructions further causes the processing device to:
generate weights for the correlation measures based on at least the component-level information; and
determine weighted correlation measures for the components based on at least the weights and the correlation measures.
3 . The system of claim 2 , wherein the weights indicate a priority level for the components.
4 . The system of claim 2 , wherein executing the instructions further causes the processing device to:
determine a second sequence in which the mitigation protocols are to be implemented based on at least the weighted correlation measures; and
implement the mitigation protocols on the components in the second sequence.
5 . The system of claim 2 , wherein executing the instructions further causes the processing device to:
determine subsets of mitigation protocols corresponding to the weighted correlation measures; and
implement the subsets of mitigation protocols on the components based on at least the weighted correlation measures.
6 . The system of claim 1 , wherein the correlation measures indicate a level of co-linear relationship between the components.
7 . A computer program product for component-level threat assessment in a computing environment, the computer program product comprising a non-transitory computer-readable medium comprising code causing an apparatus to:
capture state information associated with a computing environment, wherein the computing environment comprises components, wherein each component is associated with component-level information, wherein the component-level information comprises device characteristics, data usage telemetry, operational statistics, information associated with applications stored thereon, and historical threat vector assessment;
determine correlation measures for the components based on at least the state information, wherein the correlation measures quantify a level of dependency between the components;
determine threat vectors associated with the components;
determine mitigation protocols to be implemented on the components in response to an incidence of the threat vectors on the components;
determine a first sequence in which the mitigation protocols are to be implemented based on at least the correlation measures for the components; and
implement the mitigation protocols on the components in the first sequence to reduce a propagation effect of the threat vectors across the computing environment.
8 . The computer program product of claim 7 , wherein the computer program product is further configured to:
generate one or more weights for the correlation measures based on at least the component-level information; and
determine weighted correlation measures for the components based on at least the weights and the correlation measures.
9 . The computer program product of claim 8 , wherein the weights indicate a priority level for the components.
10 . The computer program product of claim 8 , wherein the computer program product is further configured to:
determine a second sequence in which the mitigation protocols are to be implemented based on at least the weighted correlation measures; and
implement the mitigation protocols on the components in the second sequence.
11 . The computer program product of claim 8 , wherein the computer program product is further configured to:
determine subsets of mitigation protocols corresponding to the weighted correlation measures; and
implement the subsets of mitigation protocols on the components based on at least the weighted correlation measures.
12 . The computer program product of claim 7 , wherein the correlation measures indicate a level of co-linear relationship between the components.
13 . A method for component-level threat assessment in a computing environment, the method comprising:
capturing state information associated with a computing environment, wherein the computing environment comprises components, wherein each component is associated with component-level information, wherein the component-level information comprises device characteristics, data usage telemetry, operational statistics, information associated with applications stored thereon, and historical threat vector assessment;
determining correlation measures for the components based on at least the state information, wherein the correlation measures quantify a level of dependency between the components;
determining threat vectors associated with the components;
determining mitigation protocols to be implemented on the components in response to an incidence of the threat vectors on the components;
determining a first sequence in which the mitigation protocols are to be implemented based on at least the correlation measures for the components; and
implementing the mitigation protocols on the components in the first sequence to reduce a propagation effect of the threat vectors across the computing environment.
14 . The method of claim 13 , wherein the method further comprises:
generating weights for the correlation measures based on at least the component-level information; and
determining weighted correlation measures for the components based on at least the weights and the correlation measures.
15 . The method of claim 14 , wherein the weights indicate a priority level for the components.
16 . The method of claim 14 , wherein the method further comprises:
determining a second sequence in which the mitigation protocols are to be implemented based on at least the weighted correlation measures; and
implementing the mitigation protocols on the components in the second sequence.
17 . The method of claim 14 , wherein the method further comprises:
determining subsets of mitigation protocols corresponding to the weighted correlation measures; and
implementing the subsets of mitigation protocols on the components based on at least the weighted correlation measures.