Network security based on vendor network scoring with dynamic network segmentation
Mechanisms are provided for decentralized security orchestration. The mechanisms execute training, for each vendor network in the plurality of vendor networks, on a corresponding vendor network artificial intelligence (AI) computer model. The training is executed with training data collected from a corresponding vendor network over time, where the training data represents transactions occurring within the corresponding vendor network. The trained models are executed on new security information to thereby classify activity in portions of the data processing system as to a security risk level. Fuzzy logic is executed on the classifications to automatically determine if segmentation of the data processing system is to be performed. If segmentation is to be performed, the mechanisms segment/isolate portions having a predetermined security risk level classification.
1 . A method for decentralized security orchestration in a data processing system comprising a plurality of vendor networks, the method comprising:
executing machine learning training, for each vendor network in the plurality of vendor networks, on a corresponding vendor network artificial intelligence (AI) computer model to thereby generate a plurality of trained vendor network AI computer models, wherein the machine learning training is executed with training data collected from a corresponding vendor network over time as input to the corresponding vendor network AI computer model, and wherein the training data represents transactions occurring within the corresponding vendor network;
executing the plurality of trained vendor network AI computer models on new security information collected from the plurality of vendor networks of the data processing system, to thereby classify activity in portions of the data processing system as to a security risk level;
executing fuzzy logic on the classifications of activity in portions of the data processing system to automatically determine whether segmentation of the data processing system is to be performed or not due to a portion of the data processing system having a predetermined security risk level classification; and
in response to the fuzzy logic indicating that segmentation is to be performed, automatically segmenting the data processing system to isolate the portion of the data processing system having the predetermined security risk level classification.
2 . The method of claim 1 , wherein at least two of the vendor networks in the plurality of vendor networks are associated with different vendors and have different vendor network AI computer models and different trained vendor network AI computer models trained on different training data collected from the corresponding different vendor networks.
3 . The method of claim 1 , further comprising, in response to a determination that segmentation is to be performed with regard to the portion of the data processing system having the predetermined security risk level classification, transmitting security threat data, from a first trained vendor network AI computer model associated with a vendor network corresponding to the portion of the data processing system having the predetermined security risk level classification, to one or more second trained vendor network AI computer models in the plurality of trained vendor network AI computer models.
4 . The method of claim 3 , wherein the security threat data that is transmitted is anonymized to remove vendor specific information from the security threat data prior to transmission.
5 . The method of claim 1 , further comprising, in response to the fuzzy logic indicating that segmentation is to be performed, automatically generating a new segment of the data processing system and moving the portion of the data processing system having the predetermined security risk level classification to the new segment.
6 . The method of claim 5 , wherein the portion of the data processing system having the predetermined security risk level classification comprises a network path between two points, a subnetwork containing clusters of related nodes, or an entire vendor network in the plurality of vendor networks.
7 . The method of claim 1 , wherein executing the fuzzy logic comprises:
computing one or more entropy metrics of the portions of the data processing system, wherein the one or more entropy metrics are a fuzzy logic function of one or more of session activities, suspicious level for activities by endpoints, user privileges, privilege changes within sessions, volume of data, and endpoint network atomicity across all endpoints within the portions of the data processing system; and
determining, for each portion of the data processing system, a corresponding security risk level classification for that portion of the data processing system based on the one or more entropy metrics.
8 . The method of claim 7 , wherein determining a corresponding security risk level classification for each portion of the data processing system comprises determining whether the entropy metric associated with that portion of the data processing system increases or decreases over time, wherein a greater decrease in an entropy metric indicates a higher security risk level classification than an increase in an entropy metric or lower decrease in an entropy metric over time.
9 . The method of claim 1 , wherein each component of the data processing system has a unique and immutable identity on a blockchain, and wherein entries in the blockchain are added based on the new security information to maintain an immutable record of activity in the data processing system.
10 . The method of claim 1 , wherein the new security information is real-time security information and wherein the operations of executing the plurality of trained vendor network AI computer models on the new security information, executing the fuzzy logic on the classifications of activity in portions of the data processing system, and automatically segmenting the data processing system to isolate the portion having the predetermined security risk level classification are performed dynamically based on the real-time security information.
11 . A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed in a data processing system, causes the data processing system to:
execute machine learning training, for each vendor network in the plurality of vendor networks, on a corresponding vendor network artificial intelligence (AI) computer model to thereby generate a plurality of trained vendor network AI computer models, wherein the machine learning training is executed with training data collected from a corresponding vendor network over time as input to the corresponding vendor network AI computer model, and wherein the training data represents transactions occurring within the corresponding vendor network;
execute the plurality of trained vendor network AI computer models on new security information collected from the plurality of vendor networks of the data processing system, to thereby classify activity in portions of the data processing system as to a security risk level;
execute fuzzy logic on the classifications of activity in portions of the data processing system to automatically determine whether segmentation of the data processing system is to be performed or not due to a portion of the data processing system having a predetermined security risk level classification; and
in response to the fuzzy logic indicating that segmentation is to be performed, automatically segment the data processing system to isolate the portion of the data processing system having the predetermined security risk level classification.
12 . The computer program product of claim 11 , wherein at least two of the vendor networks in the plurality of vendor networks are associated with different vendors and have different vendor network AI computer models and different trained vendor network AI computer models trained on different training data collected from the corresponding different vendor networks.
13 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to transmit, in response to a determination that segmentation is to be performed with regard to the portion of the data processing system having the predetermined security risk level classification, security threat data, from a first trained vendor network AI computer model associated with a vendor network corresponding to the portion of the data processing system having the predetermined security risk level classification, to one or more second trained vendor network AI computer models in the plurality of trained vendor network AI computer models.
14 . The computer program product of claim 13 , wherein the security threat data that is transmitted is anonymized to remove vendor specific information from the security threat data prior to transmission.
15 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to automatically generate, in response to the fuzzy logic indicating that segmentation is to be performed, a new segment of the data processing system and moving the portion of the data processing system having the predetermined security risk level classification to the new segment.
16 . The computer program product of claim 15 , wherein the portion of the data processing system having the predetermined security risk level classification comprises a network path between two points, a subnetwork containing clusters of related nodes, or an entire vendor network in the plurality of vendor networks.
17 . The computer program product of claim 11 , wherein the computer readable program further causes the data processing system to execute the fuzzy logic at least by:
computing one or more entropy metrics of the portions of the data processing system, wherein the one or more entropy metrics are a fuzzy logic function of one or more of session activities, suspicious level for activities by endpoints, user privileges, privilege changes within sessions, volume of data, and endpoint network atomicity across all endpoints within the portions of the data processing system; and
determining, for each portion of the data processing system, a corresponding security risk level classification for that portion of the data processing system based on the one or more entropy metrics.
18 . The computer program product of claim 17 , wherein determining a corresponding security risk level classification for each portion of the data processing system comprises determining whether entropy metric associated with that portion of the data processing system increases or decreases over time, wherein a greater decrease in an entropy metric indicates a higher security risk level classification than an increase in an entropy metric or lower decrease in an entropy metric over time.
19 . The computer program product of claim 11 , wherein each component of the data processing system has a unique and immutable identity on a blockchain, and wherein entries in the blockchain are added based on the new security information to maintain an immutable record of activity in the data processing system.
20 . An apparatus comprising:
at least one processor; and
at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to:
execute machine learning training, for each vendor network in the plurality of vendor networks, on a corresponding vendor network artificial intelligence (AI) computer model to thereby generate a plurality of trained vendor network AI computer models, wherein the machine learning training is executed with training data collected from a corresponding vendor network over time as input to the corresponding vendor network AI computer model, and wherein the training data represents transactions occurring within the corresponding vendor network;
execute the plurality of trained vendor network AI computer models on new security information collected from the plurality of vendor networks of the data processing system, to thereby classify activity in portions of the data processing system as to a security risk level;
execute fuzzy logic on the classifications of activity in portions of the data processing system to automatically determine whether segmentation of the data processing system is to be performed or not due to a portion of the data processing system having a predetermined security risk level classification; and
in response to the fuzzy logic indicating that segmentation is to be performed, automatically segment the data processing system to isolate the portion of the data processing system having the predetermined security risk level classification.