Biology based techniques with cognitive system analysis for handling information security and privacy

A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

• ingest an electronic corpus of content, wherein the electronic corpus of content comprises content specific to a domain of computer system attacks;
• perform cognitive analysis of the content of the electronic corpus to identify at least one instance of a reference to a computer attack and at least one corresponding characteristic of the computer attack, wherein the cognitive analysis comprises performing natural language processing on natural language content in the content of the electronic corpus to identify and extract the at least one instance of the reference to the computer attack and the at least one corresponding characteristic in the natural language content, wherein the at least one instance of the reference to the computer attack comprises a natural language term or phrase specifying the identifier of the computer attack, and wherein the at least one corresponding characteristic comprises one or more characteristics indicative of a severity of the corresponding computer attack;
• generate an attack profile data structure for the computer attack based on the at least one corresponding characteristic of the computer attack identified by the cognitive analysis of the content of the electronic corpus, wherein the attack profile data structure specifies the identity of the computer attack and a corresponding severity of the computer attack;
• and
• configure at least one local segment analysis and security (LSAS) engine associated with a segment of a distributed computing system based on the attack profile data structure, wherein the at least one LSAS engine determines a security response action to implement based on the attack profile data structure and transmits a control message to at least one computing resource to implement the determined security response action in response to detecting the computer attack, wherein the security response action is determined based on the corresponding severity of the computer attack specified in the attack profile data structure.

An apparatus comprising:

• a processor;
• and
• a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to:
• ingest an electronic corpus of content, wherein the electronic corpus of content comprises content specific to a domain of computer system attacks;
• perform cognitive analysis of the content of the electronic corpus to identify at least one instance of a reference to a computer attack and at least one corresponding characteristic of the computer attack, wherein the cognitive analysis comprises performing natural language processing on natural language content in the content of the electronic corpus to identify and extract the at least one instance of the reference to the computer attack and the at least one corresponding characteristic in the natural language content, wherein the at least one instance of the reference to the computer attack comprises a natural language term or phrase specifying the identifier of the computer attack, and wherein the at least one corresponding characteristic comprises one or more characteristics indicative of a severity of the corresponding computer attack;
• generate an attack profile data structure for the computer attack based on the at least one corresponding characteristic of the computer attack identified by the cognitive analysis of the content of the electronic corpus, wherein the attack profile data structure specifies the identity of the computer attack and a corresponding severity of the computer attack;
• and
• configure at least one local segment analysis and security (LSAS) engine associated with a segment of a distributed computing system based on the attack profile data structure, wherein the at least one LSAS engine determines a security response action to implement based on the attack profile data structure and transmits a control message to at least one computing resource to implement the determined security response action in response to detecting the computer attack, wherein the security response action is determined based on the corresponding severity of the computer attack specified in the attack profile data structure.