System and method thereof for multi-tiered mitigation of cyber-attacks

1. A method for controlling multi-tiered mitigation of cyber-attacks, comprising:

monitoring at least availability and load of each protection resource in a multi-tiered communication network, wherein each tier in the multi-tiered communication network includes a plurality of protection resources having capacity and security capabilities set according to the respective tier;

for each protection resource, computing a current aggregated load metric (ALM);

determining based on at least one of the computed ALM and security capabilities of a respective protection resource, if the respective protection resource assigned to a protected entity can handle a detected cyber-attack against the protected entity; and

selecting at least one new protection resource to secure the protected entity, upon determining the protection resource cannot handle the detected cyber-attack, wherein the selection is based on at least one of the computed ALM and a security capabilities of the at least one protection resource, wherein the at least one new protection resource is included at a higher tier than a tier of the multi-tiered communication network that the protected entity resides.

2. The method of claim 1 , further comprising:

gathering information related to the each protection resource and the multi-tiered communication network.

3. The method of claim 1 , wherein monitoring the at least availability and load of each protection resource further comprises:

monitoring a plurality of load parameters respective of the load of each protection resource; and

comparing a value for each monitor load parameter based on current load conditions.

4. The method of claim 3 , wherein each the plurality of load parameters comprises any one of: a CPU load condition, a memory load condition, a number of provisioned security services, a ratio between a current used security services and a total security service, and a load condition of a link connecting the protected entity.

5. The method of claim 3 , wherein the computed ALM is a unified metric representing the global normalized load on a respective protection resource.

6. The method of claim 1 , wherein computing the current ALM further comprises:

computing the ALM only to an available protection resource as a maximum value among all load parameters' normalized values.

7. The method of claim 1 , wherein the at least one new protection resource is selected from a plurality of available protection resources operable in any tier in the multi-tiered communication network.

8. The method of claim 1 , wherein selecting the at least one new protection resource further comprises:

evaluating at least one selection parameter;

assigning a weight to the at least one selection parameter;

computing a selection score for each of the plurality of available protection resources; and

selecting the new protection resource respective of the computed selection score.

9. The method of claim 8 , wherein computing the selection score further comprises:

computing a linear combination of the at least one selection parameter and its respective weight; and

selecting a protection resource having the lowest selection score as the new protection resource.

10. The method of claim 8 , wherein computing the selection score further comprises:

computing a maximum among the at least one selection parameter multiplied by its respective weight; and

selecting a protection resource having the lowest selection score as the new protection resource.

11. The method of claim 8 , wherein the at least one selection parameter is any one of:

security and mitigation capabilities of the mitigation of the resource, a peer point proximity, a computed ALM, user preferences, a SLA guaranteed to a security service, dynamic proximity to peers, a security risk distribution, the detected cyber-attack persistency, the detected cyber-attack class, the detected cyber-attack, the detected cyber-attack scale, and the detected cyber-attack volume.

12. The method of claim 1 , further comprising:

assigning the new selected protection resource to the protected entity; and

diverting incoming traffic to the new selected protection resource.

13. The method of claim 1 , wherein the multi-tiered communication network includes at least one of: a cloud-tier designed to handle cyber-attacks at the Internet; a backbone-tier designed to handle cyber-attacks at a backbone network, an edge-tier designed to handle cyber-attacks at edge networks; and an entity-tier designed to handle cyber-attacks at the protected entities.

14. The method of claim 13 , wherein protection resources in the cloud-tier are configured with the highest capacity, while protection resources in the entity-tier are configured with the lower capacity, wherein protection resources in the backbone-tier are configured with capacity higher than the protection resources in the edge-tier.

15. The method of claim 14 , wherein the protection resources in the edge-tier and entity-tier are configured to detect and mitigate cyber-attacks, while the protection resources in the backbone-tier are configured to mitigate cyber-attacks.

16. The method of claim 1 , wherein the detected handle cyber-attack is any one of: a denial of service (DoS) attack and a distributed DoS (DDoS) attack.

17. The method of claim 1 , wherein the determination whether the respective protection resource assigned to a protected entity can efficiently handle a detected cyber-attack against the protected entity is based on at least one selection parameter.

18. A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for controlling multi-tiered mitigation of cyber-attacks, the process comprising:

monitoring at least availability and load of each protection resource in a multi-tiered communication network, wherein each tier in the multi-tiered communication network includes a plurality of protection resources having capacity and security capabilities set according to the respective tier;

for each protection resource, computing a current aggregated load metric (ALM);

determining based on at least one of the computed ALM and security capabilities of a respective protection resource, if the respective protection resource assigned to a protected entity can handle a detected cyber-attack against the protected entity; and

selecting at least one new protection resource to secure the protected entity, upon determining the protection resource cannot handle the detected cyber-attack, wherein the selection is based on at least one of the computed ALM and a security capabilities of the at least one protection resource, wherein the at least one new protection resource is included at a higher tier than a tier of the multi-tiered communication network that the protected entity resides.

19. A system for controlling multi-tiered mitigation of cyber-attacks, comprising:

at least one processing unit; and a memory, the memory containing instructions that, when executed by the at least one processing unit, configure the system to:

monitor at least availability and load of each protection resource in a multi-tiered communication network, wherein each tier in the multi-tiered communication network includes a plurality of protection resources having capacity and security capabilities set according to the respective tier;

for each protection resource, compute a current aggregated load metric (ALM);

determine based on at least one of the computed ALM and security capabilities of a respective protection resource, if the respective protection resource assigned to a protected entity can handle a detected cyber-attack against the protected entity; and

select at least one new protection resource to secure the protected entity, upon determining the protection resource cannot handle the detected cyber-attack, wherein the selection is based on at least one of the computed ALM and a security capabilities of the at least one protection resource, wherein the at least one new protection resource is included at a higher tier than a tier of the multi-tiered communication network that the protected entity resides.

20. The system of claim 19 , further configured to:

gather information related to the each protection resource and the multi-tiered communication network.

21. The system of claim 19 , wherein when monitoring the at least availability and load of each protection resource, the system is further configured to:

monitor a plurality of load parameters respective of the load of each protection resource; and

compare a value for each monitor load parameter based on current load conditions.

22. The system of claim 21 , wherein each the plurality of load parameters comprises any one of: a CPU load condition, a memory load condition, a number of provisioned security services, a ratio between a current used security services and a total security service, and a load condition of a link connecting the protected entity.

23. The system of claim 21 , wherein the computed ALM is a unified metric representing the global load on a respective protection resource.

24. The system of claim 19 , wherein when computing the current ALM, the system is further configured to:

compute the ALM only to an available protection resource as a maximum value among all load parameters' values.

25. The system of claim 19 , wherein the at least one new protection resource is selected from a plurality of available protection resources operable in any tier in the multi-tiered communication network.

26. The system of claim 19 , wherein when selecting the at least one new protection resource, the system is further configured to:

evaluate at least one selection parameter;

assign a weight to the at least one selection parameter;

compute a selection score for each of the plurality of available protection resources; and

select the new protection resource respective of the computed selection score.

27. The system of claim 26 , wherein when computing the selection score, the system is further configured to:

compute a linear combination of the at least one selection parameter and its respective weight; and

select a protection resource having the lowest selection score as the new protection resource.

28. The system of claim 26 , wherein when computing the selection score, the systems is further configured to:

compute a maximum among the at least one selection parameter multiplied by its respective weight; and

select a protection resource having the lowest selection score as the new protection resource.

29. The system of claim 26 , wherein the at least one selection parameter is any one of:

security and mitigation capabilities of the mitigation of the resource, a peer point proximity, a computed ALM, user preferences, a SLA guaranteed to a security service, dynamic proximity to peers, a security risk distribution, the detected cyber-attack persistency, the detected cyber-attack class, the detected cyber-attack, the detected cyber-attack scale, and the detected cyber-attack volume.

30. The system of claim 19 , further configured to:

assign the new selected protection resource to the protected entity; and

divert incoming traffic to the new selected protection resource.

31. The system of claim 19 , wherein the multi-tiered communication network includes at least: a cloud-tier designed to handle cyber-attacks at the Internet; a backbone-tier designed to handle cyber-attacks at a backbone network, an edge-tier designed to handle cyber-attacks at edge networks; and an entity-tier designed to handle cyber-attacks at the protected entities.

32. The system of claim 31 , wherein protection resources in the cloud-tier are configured with the highest capacity, while protection resources in the entity-tier are configured with the lower capacity, wherein protection resources in the backbone-tier are configured with capacity higher than the protection resources in the edge-tier.

33. The system of claim 32 , wherein the protection resources in the edge-tier and entity-tier are configured to detect and mitigate cyber-attacks, while the protection resources in the backbone-tier are configured to mitigate cyber-attacks.

34. The system of claim 19 , wherein the detected handle cyber-attack is any one of: a denial of service (DoS) attack and a distributed DoS (DDoS) attack.

35. The system of claim 19 , wherein the determination whether the respective protection resource assigned to a protected entity can handle a detected cyber-attack against the protected entity is based on at least one selection parameter.