Visualization tool for real-time network risk assessment
The present disclosure relates to methods and apparatus that collect data regarding malware threats, that organizes this collected malware threat data, and that provides this data to computers or people such that damage associated with these software threats can be quantified and reduced. The present disclosure is also directed to preventing the spread of malware before that malware can damage computers or steal computer data. Methods consistent with the present disclosure may optimize tests performed at different levels of a multi-level threat detection and prevention system. As such, methods consistent with the present disclosure may collect data from various sources that may include endpoint computing devices, firewalls/gateways, or isolated (e.g. “sandbox”) computers. Once this information is collected, it may then be organized, displayed, and analyzed in ways that were not previously possible.
1 . A method for visualizing a spread of malware, the method comprising:
receiving information regarding at least one type of malware threat targeting a computer network that is protected by a plurality of different malware protection layers corresponding to different types of malware threats;
performing a first set of malware tests associated with a first protection layer of the plurality of malware protection layers and a second set of malware tests associated with a second protection layer of the plurality of malware protection layers in response to the at least one type of malware threat, wherein the first set of malware tests includes one or more of content filtering using universal resource locators (URL), botnet filtering, firewall or gateway virus inspection scanning, or intrusion prevention and the second set of malware test is different as compared to the first set of malware test:
generating a visualization that illustrates the computer network as being surrounded by the plurality of different malware protection layers and that illustrates a movement of the at least one type of malware threat moving toward, through, or stopping at the first protection layer and at the second protection layer based on results of the first set of malware tests and of the second set of malware tests; and
presenting the visualization of the movement of the at least one type of malware threat within a user interface on a display of an electronic device, wherein the user interface includes one or more options for enabling or disabling one or more of the different malware protection layers associated with the computer network.
2 . The method of claim 1 , wherein the visualization dynamically illustrates the at least one type of malware threat moving relative to the first protection layer.
3 . The method of claim 2 , wherein the at least one type of malware threat is illustrated in the dynamic illustration as moving toward, through, or stopping at one or more of the different malware protection layers.
4 . The method of claim 1 , wherein the at least one type of malware threat is a new malware type, and further comprising generating one or more deep packet inspection (DPI) signatures that are characteristic of the new malware type.
5 . The method of claim 4 , further comprising providing the DPI signatures to an external computer for storage.
6 . The method of claim 1 , wherein the visualization includes one or more arrowed lines that represent the at least one type of a malware threat.
7 . The method of claim 1 , wherein the visualization includes one or more different colors for the different protection layers and the at least one type of malware threat.
8 . The method of claim 1 , wherein the visualization is generated in real-time or in near-real-time with receipt of test data from the first set of malware tests.
9 . A system for visualizing a spread of malware, the system comprising:
a communication interface that communicates over a communication network to receive information regarding at least one type of malware threat targeting a computer network that is protected by a plurality of different malware protection layers corresponding to different types of malware threats; and
a processor that executes instructions stored in memory, wherein the processor executes the instructions to:
perform a first set of malware tests associated with a first protection layer of the plurality of malware protection layers and a second set of malware tests associated with a second protection layer of the plurality of malware protection layers in response to the at least one type of malware threat, wherein the first set of malware tests includes one or more of content filtering using universal resource locators (URL), botnet filtering, firewall/gateway virus inspection scanning, or intrusion prevention and the second set of malware test is different as compared to the first set of malware test;
generate a visualization that illustrates the computer network as being surrounded by the plurality of different malware protection layers and that illustrates a movement of the at least one type of malware threat moving toward, through, or stopping at the first protection layer and at the second protection layer based on results of the first set of malware tests and of the second set of malware tests; and
add the visualization to a presentation of the movement of the at least one type of malware threat within a user interface on a display of an electronic device, wherein the user interface includes one or more options for enabling or disabling one or more of the different malware protection layers associated with the computer network.
10 . The system of claim 9 , wherein the visualization dynamically illustrates the at least one type of malware threat moving relative to the first protection layer.
11 . The system of claim 10 , wherein the at least one type of malware threat is illustrated in the dynamic illustration as moving toward, through, or stopping at one or more of the different malware protection layers.
12 . The system of claim 9 , wherein the at least one type of malware threat is a new malware type, and further comprising generating one or more deep packet inspection (DPI) signatures that are characteristic of the new malware type.
13 . The system of claim 12 , wherein the communication interface further provides the DPI signatures to an external computer for storage.
14 . The system of claim 9 , wherein the visualization includes one or more arrowed lines that represent the at least one type of a malware threat.
15 . The system of claim 9 , wherein the visualization includes one or more different colors for the different protection layers and the at least one type of malware threat.
16 . The system of claim 9 , wherein the visualization is generated in real-time or in near-real-time with receipt of test data from the first set of malware tests.
17 . A non-transitory, computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for visualizing a spread of malware, the method comprising:
receiving information regarding at least one type of malware threat targeting a computer network that is protected by a plurality of different malware protection layers corresponding to different types of malware threats;
performing a first set of malware tests associated with a first protection layer of the plurality of malware protection layers and a second set of malware tests associated with a second protection layer of the plurality of malware protection layers in response to the at least one type of malware threat, wherein the first set of malware tests includes one or more of content filtering using universal resource locators (URL), botnet filtering, firewall/gateway virus inspection scanning, or intrusion prevention and the second set of malware test is different as compared to the first set of malware test;
generating a visualization that illustrates the computer network as being surrounded by the plurality of different malware protection layers and that illustrates a movement of the at least one type of malware threat moving toward, through, or stopping at the first protection layer and at the second protection layer based on results of the first set of malware tests and of the second set of malware tests; and
presenting the visualization of the movement of the at least one type of malware threat within a user interface on a display of an electronic device, wherein the user interface includes one or more options for enabling or disabling one or more of the different malware protection layers associated with the computer network.