Intelligent and proactive device vulnerability detection and protection
System and methods are provided for building intelligence around IoT devices that can prioritize an attack attack sphere, such that scanning and protection can be focused on risky spheres before others that may be less at risk. The attack spheres include specific device types, vendors, geographic locations, demographics, or organizations. Priority based vulnerability scanning and protection is utilized along with the concept of attack spheres to define priority zones which may be unique. Priority computation based on trend analysis and predictive analysis is used to determine the vulnerability of specific devices and groups of devices. This will significantly reduce the attack exposure and ensures the proactive damage control.
1. A non-transitory computer-readable storage medium having computer readable code stored thereon for programming a computer to perform steps of:
determining attack threats for devices based on predictive analysis;
assigning priority to attack spheres responsive to determining the attack threats to the devices within the attack sphere;
scanning the devices based on the assigned priority, the devices in an identified priority attack sphere are one or more of scanned before other devices, scanned more frequently, and scanned at an increased level.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include:
informing a user or service provider of scanning operations and outcomes.
3. The non-transitory computer-readable storage medium of claim 1 , wherein the attack spheres are defined based on any of device types, device vendors, device models, software status, commonly used libraries, geographic location, demographic, organization, and time to identify risky spheres to focus protection.
4. The non-transitory computer-readable storage medium of claim 1 , wherein the predictive analysis is based on historic data to forecast the attack spheres that are more likely potential attack targets than others.
5. The non-transitory computer-readable storage medium of claim 1 , wherein the predictive analysis utilizes a prediction algorithm based on Machine Learning (ML).
6. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include utilizing a combination of current trend and prediction analysis to detect any emerging trend early in time.
7. The non-transitory computer-readable storage medium of claim 1 , wherein all devices concerning a user within the attack spheres are scanned with priority in order to protect the devices against lateral attacks.
8. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include one of taking corrective action, applying a security policy, blocking traffic, quarantining the devices, and advising a user to take a device offline or upgrade software for a device.
9. The non-transitory computer-readable storage medium of claim 1 , wherein the devices include Internet of Things (IoT) devices.
10. The non-transitory computer-readable storage medium of claim 1 , wherein the attack spheres are defined based on a combination of trends, predictions, and priority.
11. A method comprising steps of:
determining attack threats for devices based on predictive analysis;
assigning priority to attack spheres responsive to determining the attack threats to the devices within the attack sphere;
scanning the devices based on the assigned priority, the devices in an identified priority attack sphere are one or more of scanned before other devices, scanned more frequently, and scanned at an increased level.
12. The method of claim 11 , wherein the steps further include;
informing a user or service provider of scanning operations and outcomes.
13. The method of claim 11 , wherein the attack spheres are defined based on any of device types, device vendors, device models, software status, commonly used libraries, geographic location, demographic, organization, and time to identify risky spheres to focus protection.
14. The method of claim 11 , wherein the predictive analysis is based on historic data to forecast the attack spheres that are more likely potential attack targets than others.
15. The method of claim 11 , wherein the predictive analysis utilizes a prediction algorithm based on Machine Learning (ML).
16. The method of claim 11 , wherein the steps further include
utilizing a combination of current trend and prediction analysis to detect any emerging trend early in time.
17. The method of claim 11 , wherein all devices concerning a user within the attack spheres are scanned with priority in order to protect the devices against lateral attacks.
18. The method of claim 11 , wherein the steps further include one of taking corrective action, applying a security policy, blocking traffic, quarantining the devices, and advising a user to take a device offline or upgrade software for a device.
19. The method of claim 11 , wherein the devices include Internet of Things (IoT) devices.
20. The method of claim 11 , wherein the attack spheres are defined based on a combination of trends, predictions, and priority.