Threat activity statistical analysis driven adaptation of a control specification
Threat activity statistical analysis driven adaptive control specification includes retrieving a data structure from over a computer communications network into memory of a computing device and parsing the data structure in the memory to extract a listing of different threat activities. Threat activity statistical analysis driven adaptive control specification also includes computing in the memory a statistical analysis of the different threat activities. Finally, threat activity statistical analysis driven adaptive control specification includes responding to the statistical analysis surpassing a threshold for an identified one of the different threat activities by determining a corresponding threat incorporating the identified one of the different threat activities in an associated kill chain, retrieving a control specification addressing the corresponding threat, and modifying the control specification to address changes in the corresponding threat.
1. A method for threat activity statistical analysis driven adaptive control specification comprising:
retrieving a data structure from over a computer communications network into memory of a computing device;
parsing the data structure in the memory to extract a listing of different threat activities;
computing in the memory a statistical analysis of the different threat activities; and,
responsive to the statistical analysis surpassing a threshold for an identified one of the different threat activities, determining a corresponding threat incorporating the identified one of the different threat activities in an associated kill chain, retrieving a control specification addressing the corresponding threat, and modifying the control specification to address the corresponding threat, wherein the statistical analysis is an extrapolation of frequency at a future moment based upon a set of previously computed frequencies at previous moments, and the threshold is a threshold frequency of occurrence of the identified one of the different threat activities at the future moment.
2. The method of claim 1 , wherein the modification to the control specification is an addition of a new control.
3. The method of claim 1 , wherein the modification to the control specification is a removal of an existing control.
4. The method of claim 1 , wherein the modification to the control specification is a change to a parameter of an existing control.
5. A data processing system adapted for threat activity statistical analysis driven adaptive control specification, the system comprising:
a host computing platform comprising one or more computers, each with memory and one or more processing units including one or more processing cores; and,
a control specification module comprising computer program instructions enabled while executing in the memory of at least one of the processing units of the host computing platform to perform:
retrieving a data structure from over a computer communications network into the memory of the host computing platform;
parsing the data structure in the memory to extract a listing of different threat activities;
computing in the memory by the one or more processing units a statistical analysis of the different threat activities; and,
responsive to the statistical analysis surpassing a threshold for an identified one of the different threat activities, determining a corresponding threat incorporating the identified one of the different threat activities in an associated kill chain, retrieving a control specification addressing the corresponding threat, and modifying the control specification to address the corresponding threat, wherein the statistical analysis is an extrapolation of frequency at a future moment based upon a set of previously computed frequencies at previous moments, and the threshold is a threshold frequency of occurrence of the identified one of the different threat activities at the future moment.
6. The system of claim 5 , wherein the modification to the control specification is an addition of a new control.
7. The system of claim 5 , wherein the modification to the control specification is a removal of an existing control.
8. The system of claim 5 , wherein the modification to the control specification is a change to a parameter of an existing control.
9. A computing device comprising a non-transitory computer readable storage medium having program instructions stored therein, the instructions being executable by at least one processing core of a processing unit to cause the processing unit to perform a method for threat activity statistical analysis driven adaptive control specification, the method including:
retrieving a data structure from over a computer communications network into memory of a computing device;
parsing the data structure in the memory to extract a listing of different threat activities;
computing in the memory a statistical analysis of the different threat activities; and,
responsive to the statistical analysis surpassing a threshold for an identified one of the different threat activities, determining a corresponding threat incorporating the identified one of the different threat activities in an associated kill chain, retrieving a control specification addressing the corresponding threat, and modifying the control specification to address the corresponding threat, wherein the statistical analysis is an extrapolation of frequency at a future moment based upon a set of previously computed frequencies at previous moments, and the threshold is a threshold frequency of occurrence of the identified one of the different threat activities at the future moment.
10. The device of claim 9 , wherein the modification to the control specification is an addition of a new control.
11. The device of claim 9 , wherein the modification to the control specification is a removal of an existing control.
12. The device of claim 9 , wherein the modification to the control specification is a change to a parameter of an existing control.