Pre-cognitive security information and event management

1. A non-transitory computer readable medium having stored thereon machine readable instructions to provide pre-cognitive security information and event management (SIEM), the machine readable instructions, when executed, cause at least one processor to:

use trained classifiers to detect an anomaly in input events, wherein the trained classifiers are trained to learn patterns of clusters based on training events, and the trained classifiers comprise machine learning-based classifiers;

generate a predictive attack graph based on the anomaly, wherein the predictive attack graph is to provide an indication of different paths that can be taken from an asset that is related to the anomaly to compromise other selected assets in a network of the asset, and wherein the other selected assets are selected based on a ranking criterion and a complexity criterion;

generate a rank list based on the ranking criterion to include the other selected assets;

generate a complexity list based on the complexity criterion to include complexities that are related to vulnerabilities that exist in services with respect to the other selected assets; and

use the rank list, the complexity list, a depth of the predictive attack graph, and a weighted value corresponding to assets that can be reached from a current asset to generate a score that provides an indication of a number of assets that can be compromised and a difficulty of exploiting vulnerabilities related to services of the assets that can be compromised.

2. The non-transitory computer readable medium of claim 1 , wherein to generate the predictive attack graph, the machine readable instructions, when executed, further cause the at least one processor to:

determine a rank of one asset of the other selected assets; and

in response to a determination that the rank is greater than or equal to a rank threshold, select a path associated with the one asset to be added to the predictive attack graph.

3. The non-transitory computer readable medium of claim 1 , wherein to generate the rank list, the machine readable instructions, when executed, further cause the at least one processor to:

determine a rank of one asset of the other selected assets; and

in response to a determination that the rank is greater than or equal to a rank threshold, add the one asset to the rank list.

4. The non-transitory computer readable medium of claim 1 , wherein to generate the rank list, the machine readable instructions, when executed, further cause the at least one processor to:

determine a rank of one asset of the other selected assets;

determine whether a privilege associated with a user for the one asset has been previously traversed; and

in response to a determination that the privilege has been previously traversed, and the rank of the one asset is greater than or equal to a rank threshold, add the one asset to the rank list.

5. The non-transitory computer readable medium of claim 1 , wherein to generate the complexity list, the machine readable instructions, when executed, further cause the at least one processor to:

determine a complexity related to a vulnerability that exists in a service of one asset of the other selected assets; and

in response to a determination that the complexity related to the vulnerability that exists in a service of the one asset is less than a complexity threshold, add the complexity to the complexity list.

6. The non-transitory computer readable medium of claim 1 , wherein to generate the complexity list, the machine readable instructions, when executed, further cause the at least one processor to:

determine a pre-condition associated with a service of one asset of the other selected assets;

determine a post-condition associated with a service of the one asset;

determine a complexity related to a vulnerability that exists in the service of the one asset; and

in response to a determination that the complexity is less than a complexity threshold, and the pre-condition matches the post-condition, add the complexity to the complexity list.

7. The non-transitory computer readable medium of claim 1 , wherein the machine readable instructions, when executed, further cause the at least one processor to:

determine a path in the predictive attack graph that can be taken to compromise one asset of the other selected assets;

determine an occurrence of an attack associated with the path; and

create an ephemeral rule to prevent compromises of the other selected assets based on the occurrence.

8. The non-transitory computer readable medium of claim 1 , wherein the machine readable instructions, when executed, further cause the at least one processor to:

generate recommendations to overcome an attack related to the anomaly in the input events, wherein the recommendations include options related to at least one of minimizing a time associated with a loss of service, minimizing damage to physical assets, and minimizing a cost associated with the loss of service.

9. The non-transitory computer readable medium of claim 1 , wherein to generate the score, the machine readable instructions, when executed, further cause the at least one processor to:

determine a real-time connectivity model of the network; and

use the real-time connectivity model to update the generation of the score.

10. A pre-cognitive security information and event management (SIEM) apparatus comprising:

at least one processor;

an anomaly detection module, executed by the at least one processor, to use trained classifiers to detect an anomaly in input events, wherein the trained classifiers are trained to learn patterns of clusters based on training events, and the trained classifiers comprise machine learning-based classifiers; and

a predictive attack graph generation module, executed by the at least one processor, to generate a predictive attack graph based on the anomaly in the input events, wherein the predictive attack graph is to provide an indication of different paths that can be taken from a state that is related to the anomaly to compromise other selected states related to the state, wherein the other selected states are selected based on a ranking criterion and a complexity criterion, and wherein the predictive attack graph generation module is to generate a rank list based on the ranking criterion to include the other selected states, generate a complexity list based on the complexity criterion to include complexities that are related to vulnerabilities with respect to the other selected states, and use the rank list, the complexity list, and a depth of the predictive attack graph to generate a score that provides an indication of a number of states that can be compromised and a difficulty of exploiting vulnerabilities with respect to the states that can be compromised.

11. The pre-cognitive STEM apparatus according to claim 10 , wherein the state is related to other states, and wherein to generate the predictive attack graph, the predictive attack graph generation module is further executed by the at least one processor to:

determine a rank of one state of the other states; and

in response to a determination that the rank is greater than or equal to a rank threshold, select a path associated with the one state to be added to the predictive attack graph.

12. The pre-cognitive SIEM apparatus according to claim 10 , wherein the state is related to other states, and wherein to generate the complexity list, the predictive attack graph generation module is further executed by the at least one processor to:

determine a complexity related to a vulnerability that exists in one state of the other states; and

in response to a determination that the complexity is less than a complexity threshold, add the complexity to the complexity list.

13. A method for pre-cognitive security information and event management (SIEM), the method comprising:

using trained classifiers to detect an anomaly in input events, wherein the trained classifiers are trained to learn patterns of clusters based on training events, and the trained classifiers comprise machine learning-based classifiers;

generating, by at least one processor, a predictive attack graph based on the anomaly in the input events, wherein the predictive attack graph is to provide an indication of different paths that can be taken from an activity that is related to the anomaly to compromise other selected activities related to the activity, and wherein the other selected activities are selected based on a ranking criterion and a complexity criterion;

generating a rank list based on the ranking criterion to include the other selected activities;

generating a complexity list based on the complexity criterion to include complexities that are related to vulnerabilities with respect to the other selected activities; and

using the rank list, the complexity list, and a depth of the predictive attack graph to generate a score that provides an indication of a number of activities that can be compromised and a difficulty of exploiting vulnerabilities with respect to the activities that can be compromised.

14. The method according to claim 13 , wherein the activity is related to other activities, and wherein generating the predictive attack graph further comprises:

determining a rank of one activity of the other activities; and

in response to a determination that the rank of the one activity is greater than or equal to a rank threshold, selecting a path associated with the one activity to be added to the predictive attack graph.

15. The method according to claim 13 , wherein the activity is related to other activities, and wherein generating the complexity list further comprises:

determining a complexity related to a vulnerability that exists in one activity of the other activities; and

in response to a determination that the complexity is less than a complexity threshold, adding the complexity to the complexity list.