Automated security vulnerability exploit tracking on social media
Embodiments automate tracking of exploit information related to initially-identified security vulnerabilities, through the data mining of social networks. Certain social network communities (e.g., those frequented by hackers) share information about computer security breaches (zero-day events). Embodiments recognize that further relevant security information may be revealed, in conjunction with and/or subsequent to such initial zero-day vulnerability disclosures. That additional information can include valuable details regarding known (or unknown) vulnerabilities, exploit codes and methodologies, patches, etc. Tracking that additional information can benefit security researchers/experts/law enforcement personnel. Embodiments monitoring social media traffic based upon initial security vulnerability information, perform analysis to detect patterns and create relevant keywords therefrom. Those keywords in turn form a basis for generating social media stream(s) responsible for harvesting additional security-relevant data. Results of further analysis of the social media stream can be fed back in an iterative manner to refine pattern detection, keyword creation, and media stream generation.
1. A computer-implemented method comprising:
referencing, by an in-memory database engine, a zero-day security vulnerability to generate a parameter;
communicating, by the in-memory database engine, the parameter to a streaming component;
receiving, by the in-memory database engine, data harvested according to the parameter by the streaming component;
processing, by the in-memory database engine, the data according to a ruleset to generate information relating to an exploit of the zero-day security vulnerability;
storing, by the in-memory database engine, the information in an in-memory database;
communicating, by the in-memory database engine, the information as an alert to a user and to others on a distribution list;
generating, by the in-memory database engine, an updated parameter from the information;
sending, by the in-memory database engine, the updated parameter to the streaming component;
receiving by the in-memory database engine from the streaming component, updated data harvested according to the updated parameter, wherein:
the updated data indicates a patch of the zero-day security vulnerability;
halting streaming activity related to the zero-day security vulnerability by the streaming component upon receiving the updated data including the patch;
processing by the in-memory database engine, the updated data according to the ruleset to generate updated information regarding another exploit of the zero-day security vulnerability, the updated information comprising an exploit code;
storing, by the in-memory database engine, the updated information; and
communicating, by the in-memory database engine, the updated information to the user, wherein the zero-day security vulnerability is fixed by referencing the exploit code in the communicated updated information.
2. A method as in claim 1 wherein the data includes a date of the zero-day security vulnerability, a date of the exploit, a product identity, a hacker identity, a nature of the zero-day security vulnerability, and/or an exploit methodology.
3. A method as in claim 1 further comprising processing, by the in-memory database engine, the data to compute a vulnerability score.
4. A non-transitory computer readable storage medium embodying a computer program for performing operations, said operations comprising:
referencing, by an in-memory database engine, a zero-day security vulnerability to generate a parameter;
communicating, by the in-memory database engine, the parameter to a streaming component;
receiving, by the in-memory database engine, data harvested according to the parameter by the streaming component, the parameter comprising a keyword;
processing, by the in-memory database engine, the data according to a ruleset to generate information relating to an exploit of the zero-day security vulnerability;
storing, by the in-memory database engine, the information in an in-memory database;
communicating, by the in-memory database engine, the information as an alert to a user and to others on a distribution list;
generating, by the in-memory database engine, an updated parameter from the information;
sending, by the in-memory database engine, the updated parameter to the streaming component;
receiving, by the in-memory database engine from the streaming component, updated data harvested according to the updated parameter, wherein:
the updated data indicates a patch of the zero-day security vulnerability;
halting streaming activity related to the zero-day security vulnerability by the streaming component upon receiving the updated data indicating the patch;
processing by the in-memory database engine, the updated data according to the ruleset to generate updated information regarding another exploit of the zero-day security vulnerability, the updated information comprising an exploit code;
storing, by the in-memory database engine, the updated information in the in-memory database; and
communicating, by the in-memory database engine, the updated information to the user, wherein the zero-day security vulnerability is fixed by referencing the exploit code in the communicated updated information.
5. A non-transitory computer readable storage medium as in claim 4 wherein the updated parameter comprises a second keyword.
6. A computer system comprising:
a memory and one or more processors;
a software program, executable on said computer system, the software program configured to cause an in-memory database engine to:
reference a zero-day security vulnerability to generate a parameter;
communicate the parameter to a streaming component;
receive data harvested by the streaming component according to the parameter;
process the data according to a ruleset to generate information relating to an exploit of the zero-day security vulnerability;
store the information in an in-memory database;
communicate the information as an alert to a user and to others on a distribution list;
generate an updated parameter from the information;
send the updated parameter to the streaming component;
receive from the streaming component, updated data harvested according to the updated parameter, wherein:
the updated data indicates a patch of the zero-day security vulnerability;
halt streaming activity related to the zero-day security vulnerability by the streaming component upon receiving the updated data indicating the patch;
process the updated data according to the ruleset to generate updated information regarding another exploit of the zero-day security vulnerability, the updated information comprising an exploit code;
store the updated information in the in-memory database; and
communicate the updated information to the user, wherein the zero-day security vulnerability is fixed by referencing the exploit code in the communicated updated information.
7. A computer system as in claim 6 wherein the parameter comprises a keyword.