Mitigating threats in a network

1. A method for mitigating threats in a network, comprising:

receiving a message at a network device coupled to a network comprising a plurality of different types of network devices, the message generated in response to a threat and broadcasted over the network to the network device and the plurality of different types of network devices, the message comprising a plurality of device-independent parameters capable of being processed by the network device and the plurality of different types of network devices, the plurality of device-independent parameters comprising a severity parameter and an action parameter, the severity parameter indicating a severity level for the message, the action parameter indicating a device-independent operation to be performed by the network device, the network device and the plurality of different types of network devices each having one or more mapping rules that map the device-independent operation to one or more device-specific operations operable to mitigate the threat;

establishing the device-independent operation from the message;

identifying the one or more mapping rules that correspond to the established device-independent operation;

determining the one or more device-specific operations in accordance with the one or more identified mapping rules;

converting the plurality of device-independent parameters into the one or more device-specific operations operable to mitigate the threat;

performing the one or more device-specific operations to mitigate the threat;

sending, to the entity from which the message was received, a response to the message based on the performance of the one or more device-specific operations; and

further comprising sending state information for the network device to the entity from which the message was received and receiving an update to the message from the entity based on the state information.

2. The method of claim 1 , wherein the plurality of device-independent parameters further comprises:

a device type parameter indicating a device type;

a priority parameter indicating a priority for the message; and

a traffic parameter indicating traffic corresponding to the threat.

3. The method of claim 1 , further comprising:

identifying a device type parameter from the plurality of device-independent parameters; and

establishing whether the message applies to the network device according to the device type parameter.

4. The method of claim 1 , wherein performing the one or more device-specific operations comprises applying an Access Control List (ACL).

5. The method of claim 1 , further comprising authenticating the message using a public/private key authentication technique.

6. The method of claim 1 ,

wherein the update to the message is a retransmission of the message.

7. A network device operable to mitigate threats in a network, comprising:

an interface, including a hardware processor, coupled to a network comprising a plurality of different types of network devices, operable to:

receive a message, the message generated in response to a threat and broadcasted over the network to the network device and the plurality of different types of network devices, the message comprising a plurality of device-independent parameters capable of being processed by the network device and the plurality of different types of network devices, the plurality of device-independent parameters comprising a severity parameter and an action parameter, the severity parameter indicating a severity level for the message, the action parameter indicating a device-independent operation to be performed by the network device, the network device and the plurality of different types of network devices each having one or more mapping rules that map the device-independent operation to one or more device-specific operations operable to mitigate the threat; and

a processor operable to:

establish the device-independent operation from the message;

identify the one or more mapping rules that correspond to the established device-independent operation;

determine the one or more device-specific operations in accordance with the one or more identified mapping rules;

convert the plurality of device-independent parameters into the one or more device-specific operations operable to mitigate the threat;

perform the one or more device-specific operations to mitigate the threat; and

send, to the entity from which the message was received, state information for the network device and a response to the message based on the performance of the one or more device-specific operations; and

wherein the network device is further operable to receive an update to the message from the entity based on the state information.

8. The network device of claim 7 , wherein the plurality of device-independent parameters further comprises:

a device type parameter indicating a device type;

a priority parameter indicating a priority for the message; and

a traffic parameter indicating traffic corresponding to the threat.

9. The network device of claim 7 , the processor further operable to:

identify a device type parameter from the plurality of device-independent parameters; and

establish whether the message applies to the network device according to the device type parameter.

10. The network device of claim 7 , the processor further operable to perform the one or more device-specific operations by applying an Access Control List (ACL).

11. The network device of claim 7 , the processor further operable to authenticate the message using a public/private key authentication technique.

12. Logic for mitigating threats in a network, the logic embodied in a non-transitory computer-readable medium and operable to:

receive a message at a network device coupled to a network comprising a plurality of different types of network devices, the message generated in response to a threat and broadcasted over the network to the network device and the plurality of different types of network devices, the message comprising a plurality of device-independent parameters capable of being processed by the network device and the plurality of different types of network devices, the plurality of device-independent parameters comprising a severity parameter and an action parameter, the severity parameter indicating a severity level for the message, the action parameter indicating a device-independent operation to be performed by the network device, the network device and the plurality of different types of network devices each having one or more mapping rules that map the device-independent operation to one or more device-specific operations operable to mitigate the threat;

establish the device-independent operation from the message;

identify the one or more mapping rules that correspond to the established device-independent operation;

determine the one or more device-specific operations in accordance with the one or more identified mapping rules;

convert the plurality of device-independent parameters into the one or more device-specific operations operable to mitigate the threat;

perform the one or more device-specific operations to mitigate the threat;

send, to the entity from which the message was received, state information for the network device and a response to the message based on the performance of the one or more device-specific operations; and

wherein the logic is further operable to receive an update to the message from the entity based on the state information.

13. The logic of claim 12 , wherein the plurality of device-independent parameters further comprises:

a device type parameter indicating a device type;

a priority parameter indicating a priority for the message; and

a traffic parameter indicating traffic corresponding to the threat.

14. The logic of claim 12 , the logic further operable to:

identify a device type parameter from the plurality of device-independent parameters; and

establish whether the message applies to the network device according to the device type parameter.

15. The logic of claim 12 , the logic further operable to perform the one or more device-specific operations by applying an Access Control List (ACL).

16. The logic of claim 12 , the logic further operable to authenticate the message using a public/private key authentication technique.

17. A system for mitigating threats in a network, comprising:

a controller comprising one or more hardware processors, the controller operable to:

generate a message in response to a threat; and

broadcast the message over a network comprising a network device and a plurality of different types of network devices, the message comprising a plurality of device-independent parameters capable of being processed by the network device and the plurality of different types of network devices; and

the network device comprising one or more hardware processors, the network device coupled to the network operable to:

receive the message, the plurality of device-independent parameters comprising a severity parameter and an action parameter, the severity parameter indicating a severity level for the message, the action parameter indicating a device-independent operation to be performed by the network device, the network device and the plurality of different types of network devices each having one or more mapping rules that map the device-independent operation to one or more device-specific operations operable to mitigate the threat;

establish the device-independent operation from the message;

identify the one or more mapping rules that correspond to the established device-independent operation;

determine the one or more device-specific operations in accordance with the one or more identified mapping rules;

convert the plurality of device-independent parameters into the one or more device-specific operations operable to mitigate the threat;

perform the one or more device-specific operations to mitigate the threat;

send, to the controller from which the message was received, a response to the message based on the performance of the one or more device-specific operations; and

send state information for the network device to the controller and receive an update to the message from the controller based on the state information.

18. The system of claim 17 , wherein the plurality of device-independent parameters further comprises:

a device type parameter indicating a device type;

a priority parameter indicating a priority for the message; and

a traffic parameter indicating traffic corresponding to the threat.

19. The system of claim 17 , the network device further operable to:

identify a device type parameter from the plurality of device-independent parameters; and

establish whether the message applies to the network device according to the device type parameter.

20. The system of claim 17 , the network device further operable to perform the one or more device-specific operations by applying an Access Control List (ACL).

21. The system of claim 17 , wherein the controller is further operable to sign the message; and

wherein the network device is further operable to authenticate the message using a public/private key authentication technique.

22. A controller operable to mitigate threats in a network, comprising:

a hardware processor operable to:

generate a message in response to a threat, the message comprising a plurality of device-independent parameters capable of being processed by a network device and a plurality of different types of network devices; and

an interface comprising one or more hardware processors coupled to a network comprising the network device and the plurality of different types of network devices operable to:

broadcast the message over the network, the network device operable to:

receive the message, the plurality of device-independent parameters comprising a severity parameter and an action parameter, the severity parameter indicating a severity level for the message, the action parameter indicating a device-independent operation to be performed by the one or more network devices, the network device and the plurality of different types of network devices each having one or more mapping rules that map the device-independent operation to one or more device-specific operations operable to mitigate the threat;

establish the device-independent operation from the message;

identify the one or more mapping rules that correspond to the established device-independent operation;

determine the one or more device-specific operations in accordance with the one or more identified mapping rules;

convert the plurality of device-independent parameters into the one or more device-specific operations operable to mitigate the threat;

perform the one or more device-specific operations to mitigate the threat;

send, to the hardware processor from which the message was received, a response to the message based on the performance of the one or more device-specific operations; and

send state information for the network device to the processor and receive an update to the message from the processor based on the state information.

23. The controller of claim 22 , wherein the plurality of device-independent parameters further comprises:

a device type parameter indicating a device type;

a priority parameter indicating a priority for the message; and

a traffic parameter indicating traffic corresponding to the threat.