Threat detection and mitigation in a networked environment
One example method includes obtaining, based on network activity related to an object deployed within a networked environment, a number of threat events for the object and a corresponding set of severity scores. An aggregate risk score can be generated for the object based on the number of threat events and the corresponding severity scores. The aggregate risk score can be refined based on at least one weighting parameter to obtain an intermediate score. The intermediate score can be scaled, using a scaling function, to obtain an overall risk score that represents a value within a predefined numerical range. Access of the object to system resources can be controlled based on whether the overall risk score exceeds the predetermined risk threshold value, with access being allowed when the overall risk score exceeds the predetermined threshold and access being restricted when the overall risk score does not exceed the predetermined threshold.
1. A computer-implemented method, comprising:
obtaining, based on network activity related to an object deployed within a networked environment, a number of threat events for the object and a corresponding set of severity scores;
generating an aggregate risk score for the object based on the number of threat events and the corresponding set of severity scores, wherein the aggregate risk score is generated using the following equation:
Aggregrate
Risk
Score
=
∑
i
severity
i
*
events_count
i
wherein severity i represents a severity score of i th type of threat event, and events_count i represents a number of threat events of the i th type;
refining the aggregate risk score based on at least one weighting parameter to obtain an intermediate score;
scaling, using a scaling function, the intermediate score to obtain an overall risk score that represents a value within a predefined numerical range; and
controlling access of the object to system resources based on whether the overall risk score exceeds a predetermined risk threshold value.
2. The computer-implemented method of claim 1 , wherein the scaling function is a logarithmic sigmoid function.
3. The computer-implemented method of claim 2 , wherein the logarithmic sigmoid function is represented by the following function:
ln
(
1
+
x
/
w
)
1
+
ln
(
1
+
x
/
w
)
wherein x represents the intermediate score and w represents a tunable weight parameter.
4. The computer-implemented method of claim 1 , wherein the at least one weighting parameter comprises one or more of: a number of distinct use cases triggered during the number of threat events, a number of MITRE attacks tactics used during the number of threat events, and a category of the object.
5. The computer-implemented method of claim 4 , wherein the intermediate score is determined using the following equation:
Intermediate score=Aggregate Risk Score*Category*use_case_count*2 tactic_count
wherein Category represents a category of the object, use_case_count represents a number of distinct use cases triggered during the number of threat events, and tactic_count represents a number of MITRE attacks tactics used during the number of threat events.
6. The computer-implemented method of claim 1 , wherein the number of threat events for the object and the corresponding set of severity scores are obtained in response to determining:
an anomalous behavior by the object; or
occurrence of a predetermined event that triggers risk score generation for a plurality of objects in the networked environment.
7. The computer-implemented method of claim 1 , wherein the predefined numerical range is a numerical range between 0.0 and 1.0.
8. The computer-implemented method of claim 1 , wherein controlling the access of the object to the system resources comprises:
restricting access of the object to resources within the networked environment when the overall risk score exceeds the predetermined risk threshold value, or enabling access of the object to resources within the networked environment when the overall risk score does not exceed the predetermined risk threshold value.
9. A system comprising:
at least one memory storing instructions; and
at least one hardware processor interoperably coupled with the at least one memory, wherein execution of the instructions by the at least one hardware processor causes performance of operations comprising:
obtaining, based on network activity related to an object deployed within a networked environment, a number of threat events for the object and a corresponding set of severity scores;
generating an aggregate risk score for the object based on the number of threat events and the corresponding set of severity scores, wherein the aggregate risk score is generated using the following equation:
Aggregrate
Risk
Score
=
∑
i
severity
i
*
events_count
i
wherein severity i represents a severity score of i th type of threat event, and events_count i represents a number of threat events of the i th type;
refining the aggregate risk score based on at least one weighting parameter to obtain an intermediate score;
scaling, using a scaling function, the intermediate score to obtain an overall risk score that represents a value within a predefined numerical range; and
controlling access of the object to system resources based on whether the overall risk score exceeds a predetermined risk threshold value.
10. The system of claim 9 , wherein the scaling function is a logarithmic sigmoid function.
11. The system of claim 10 , wherein the logarithmic sigmoid function is represented by the following function:
ln
(
1
+
x
/
w
)
1
+
ln
(
1
+
x
/
w
)
wherein x represents the intermediate score and w represents a tunable weight parameter.
12. The system of claim 9 , wherein the at least one weighting parameter comprises one or more of: a number of distinct use cases triggered during the number of threat events, a number of MITRE attacks tactics used during the number of threat events, and a category of the object.
13. The system of claim 12 , wherein the intermediate score is determined using the following equation:
Intermediate score=Aggregate Risk Score*Category*use_case_count*2 tactic_count
wherein Category represents a category of the object, use_case_count represents a number of distinct use cases triggered during the number of threat events, and tactic_count represents a number of MITRE attacks tactics used during the number of threat events.
14. The system of claim 9 , wherein the number of threat events for the object and the corresponding set of severity scores are obtained in response to determining:
an anomalous behavior by the object; or
occurrence of a predetermined event that triggers risk score generation for a plurality of objects in the networked environment.
15. The system of claim 9 , wherein the predefined numerical range is a numerical range between 0.0 and 1.0.
16. A non-transitory, computer-readable medium storing computer-readable instructions, that upon execution by at least one hardware processor, cause performance of operations, comprising:
obtaining, based on network activity related to an object deployed within a networked environment, a number of threat events for the object and a corresponding set of severity scores;
generating an aggregate risk score for the object based on the number of threat events and the corresponding set of severity scores,wherein the aggregate risk score is generated using the following equation:
Aggregrate
Risk
Score
=
∑
i
severity
i
*
events_count
i
wherein severity i represents a severity score of i th type of threat event, and events_count i represents a number of threat events of the i th type;
refining the aggregate risk score based on at least one weighting parameter to obtain an intermediate score;
scaling, using a scaling function, the intermediate score to obtain an overall risk score that represents a value within a predefined numerical range; and
controlling access of the object to system resources based on whether the overall risk score exceeds a predetermined risk threshold value.
17. The non-transitory, computer-readable medium of claim 16 , wherein the scaling function is a logarithmic sigmoid function.
18. The non-transitory, computer-readable medium of claim 17 , wherein the logarithmic sigmoid function is represented by the following function:
ln
(
1
+
x
/
w
)
1
+
ln
(
1
+
x
/
w
)
wherein x represents the intermediate score and w represents a tunable weight parameter.
19. The non-transitory, computer-readable medium of claim 16 , wherein the at least one weighting parameter comprises one or more of: a number of distinct use cases triggered during the number of threat events, a number of MITRE attacks tactics used during the number of threat events, and a category of the object.