System and method for internet activity and health forecasting and internet noise analysis
A system and method for large-scale internet health forecasting and internet noise analysis. The system and method feature the ability to scan for, ingest and process, and then use various data stores for capturing entity data, their relationships, and actions associated with them. This data forms the basis for cyber enrichment service databases which can used to provide information responsive to user submitted queries as well as to produce large-scale (e.g., Internet scale) simulation models using statistical models, generative ML models, massively multiplayer online gaming simulation systems, or full discrete event simulation engines or some combination. User submitted queries can be ran against the raw data or against simulations to provide simulation results that can be used improve cybersecurity for an organization against actual observed behaviors or simulations.
1 . A system for large-scale internet health forecasting and internet noise analysis, comprising:
a computer system comprising a memory and a processor;
a simulation engine comprising a first plurality of programming instructions stored in the memory and operating on the processor, wherein the first plurality of programming instructions, when operating on the processor, causes the computer system to:
retrieve a first plurality of cyber enrichment service data from cyber enrichment tables comprising at least a breach content database, an event database, a vulnerability and exploit database, a threat actor database, a reputation database, an internet infrastructure health database, and a tool database;
retrieve a plurality of routing information from external routing data sources;
retrieve a plurality of internet infrastructure data from internet infrastructure scanning sources;
use the plurality of cyber enrichment service data, the plurality of routing information, and the plurality of internet infrastructure data as inputs into a multiplayer online game simulator to create a large-scale internet health simulation;
receive a user submitted query from a query engine;
dynamically retrieve a second plurality of cyber enrichment service data from the cyber enrichment service tables based on parsed query details of the user submitted query, wherein the second plurality of cyber enrichment service data comprises query-specific threat intelligence data that differs from the first plurality of cyber enrichment service data;
apply the user submitted query to the large-scale internet health simulation to determine a predictive scenario comprising at least one of a predicted cyber threat, a routing security vulnerability, an internet infrastructure health forecast, or a threat actor behavior pattern;
normalize and schematize the predictive scenario and the second plurality of cyber enrichment service data to enable interoperability between different threat intelligence taxonomies; and
return the normalized and schematized scenario and the second plurality of cyber enrichment service data as a response to the user submitted query.
2 . The system of claim 1 , wherein the multiplayer online game simulator simulates border gateway protocol interactions across autonomous systems to model internet-scale routing behavior.
3 . The system of claim 1 , wherein the cyber enrichment service data comprises event data, reputation data, vulnerability and exploit data, threat actor data, breach detail data, tool data with offensive and defensive security tool metadata, and internet infrastructure health data, and wherein the cyber enrichment service tables support normalizing and schematizing interoperability between threat intelligence feeds from different vendors.
4 . The system of claim 1 , wherein the predictive scenario comprises real-time monitoring and forecasting predictions for internet infrastructure health changes.
5 . The system of claim 1 , wherein the predictive scenario comprises routing security vulnerability assessments and border gateway protocol anomaly predictions.
6 . The system of claim 1 , wherein the predictive scenario comprises a predicted threat to internet infrastructure with associated threat actor attribution and recommended countermeasures.
7 . The system of claim 1 , further comprising the query engine comprising second plurality of programming instructions stored in the memory and operating on the processor, wherein the second plurality of programming instructions, when operating on the processor, causes the computer system to:
receive the user submitted query;
parse the user submitted query to identify relevant threat intelligence domains;
send the parsed user submitted query to the simulation engine;
receive the returned normalize and schematized scenario and the second plurality of cyber enrichment service data from the simulation engine; and
display the normalized and schematized scenario and the second plurality of cyber enrichment service data as a response to the user submitted query via a user interface with threat actor taxonomy mapping.
8 . The system of claim 1 , wherein the computer system is a cloud computing platform.
9 . A computer-implemented method for large-scale internet health forecasting and internet noise analysis, comprising the steps of:
retrieving a first plurality of cyber enrichment service data from cyber enrichment service tables comprising at least a breach content database, an event database, a vulnerability and exploit database, a threat actor database, a reputation database, an internet infrastructure health database, and a tool database;
retrieving a plurality of routing information from external routing data sources;
retrieving a plurality of internet infrastructure data from internet infrastructure scanning sources;
using the plurality of cyber enrichment service data, the plurality of routing information, and the plurality of internet infrastructure data as inputs into a multiplayer online game simulator to create a large-scale internet health simulation;
receiving a user submitted query from a query engine;
dynamically retrieving a second plurality of cyber enrichment service data from the cyber enrichment service tables based on parsed query details of the user submitted query, wherein the second plurality of cyber enrichment service data comprises query-specific threat intelligence data that differs from the first plurality of cyber enrichment service data;
applying the user submitted query to the large-scale internet health simulation to determine a predictive scenario comprising at least one of a predicted cyber threat, a routing security vulnerability, an internet infrastructure health forecast, or a threat actor behavior pattern; and
normalizing and schematizing the predictive scenario and the second plurality of cyber enrichment service data to enable interoperability between different threat intelligence taxonomies; and
returning the normalize and schematized scenario and the second plurality of cyber enrichment service data as a response the user submitted query.
10 . The computer-implemented method of claim 9 , wherein the multiplayer online game simulator simulates border gateway protocol interactions across autonomous systems to model internet-scale routing behavior.
11 . The computer-implemented method of claim 9 , wherein the cyber enrichment service data comprises event data, reputation data, vulnerability and exploit data, threat actor data, breach detail data, tool data with offensive and defensive security tool metadata, and internet infrastructure health data, and wherein the cyber enrichment service tables support normalized and schematized interoperability between threat intelligence feeds from different vendors.
12 . The computer-implemented method of claim 9 , wherein the predictive scenario comprises real-time monitoring and forecasting predictions for internet infrastructure health changes.
13 . The computer-implemented method of claim 9 , wherein the predictive scenario comprises routing security vulnerability assessments and border gateway protocol anomaly predictions.
14 . The computer-implemented method of claim 9 , wherein the predictive scenario comprises a predicted threat to internet infrastructure with associated threat actor attribution and recommended countermeasures.
15 . The computer-implemented method of claim 9 , further comprising the steps of:
receiving the user submitted query;
parsing the user submitted query to identify relevant threat intelligence domains;
sending the parsed user submitted query to the simulation engine;
receiving the returned normalize and schematized scenario and the second plurality of cyber enrichment service data from the simulation engine; and
displaying the normalize and schematized scenario and the second plurality of cyber enrichment service data as a response to the user submitted query via a user interface with threat actor taxonomy mapping.
16 . The computer-implemented method of claim 9 , wherein the computer system is a cloud computing platform.