Cyber attack early warning system

A system comprising:

• one or more processors;
• and
• a storage module communicatively coupled to the one or more processors, the storage module including
• an input engine to (i) receive data associated with an attack alert associated with an object analyzed and identified as suspicious by a remote source, the attack alert including information associated with the suspicious object having one or more characteristics associated with a malware attack, and (ii) classify the received data to produce a classified result, the classified result is to identify at least a type of a malware attack,
• an attack-specific engine communicatively coupled to the input engine, wherein the attack-specific engine comprises a plurality of attack cores each directed to analyze the classified result according to at least a specific type of malware attack and at least a first attack core of the plurality of attack cores being configured to compute an attack-specific result including one or more features that pertain to the identified malware attack being monitored by the first attack core, and
• a correlation engine communicatively coupled to the attack-specific engine, the correlation engine to compute an attack value based on at least the attack-specific result and a consideration of potential attack targets, wherein the attack value represents a probability of a potential target being attacked and is compared to a threshold value to determine whether or not to generate an alert.

A computerized method, comprising:

• receiving, by a first networked system, an attack alert associated with an object analyzed and identified as suspicious, the attack alert including information associated with the suspicious object having one or more characteristics associated with an exploit or other attack;
• and
• providing the information associated with the exploit or other attack to an attack-specific engine that conducts a plurality of analyses directed to one or more types of attacks and computes results for each of the plurality of analyses each being provided as an attack-specific result;
• receiving the attack-specific results and computing an attack value based on an analysis of extracted features from the attack alert including time-dependent features and time-independent features with features corresponding to potential targets;
• and
• generating, by the first networked system, an alert directed to one or more predicted attacks based on the attack value,
• wherein the attack-specific engine comprises a plurality of attack cores, each of the plurality of attack cores being directed to an analysis for at least a specific type of attack and at least a first attack core of the plurality of attack cores being configured to (i) extract features from the attack alert and (ii) compute an attack-specific result including one or more features of the extracted features that pertain to a first type of attack being monitored by the first attack core.