Biology based techniques for handling information security and privacy

A computer program product comprising a non-transitory computer readable medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to implement a local segment analysis and security (LSAS) engine that operates to:

• collect, from one or more agents associated with computing resources in a first segment of a computing environment, status metrics indicating a current operational status of the computing resources within the first segment;
• analyze the status metrics to determine whether the first segment is the target of a first attack on one or more computing resources of the first segment;
• receive, from one or more other LSAS engines associated with one or more second segments of the computing environment, at least one message indicating a status of the one or more second segments with regard to the one or more second segments being a target of a second attack;
• determine a security response action to implement based on the received at least one message and results of the analysis;
• and
• transmit a control message to at least one computing resource of the first segment to implement the determined security response action to control a flow of data traffic to or from the first segment, wherein determining the security response action to implement comprises:
• performing a trend analysis on the status metrics for the first segment and applying results of the trend analysis to a plurality of rules associated with corresponding security response action indicators;
• and
• automatically selecting a security response action based on a rule in the plurality of rules whose criteria are met by the results of the trend analysis and other characteristics of at least one of the first attack or second attack.

An apparatus comprising:

• a processor;
• and
• a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to implement a local segment analysis and security (LSAS) engine that operates to:
• collect, from one or more agents associated with computing resources in a first segment of a computing environment, status metrics indicating a current operational status of the computing resources within the first segment;
• analyze the status metrics to determine whether the first segment is the target of a first attack on one or more computing resources of the first segment;
• receive, from one or more other LSAS engines associated with one or more second segments of the computing environment, at least one message indicating a status of the one or more second segments with regard to the one or more second segments being a target of a second attack;
• determine a security response action to implement based on the received at least one message and results of the analysis;
• and
• transmit a control message to at least one computing resource of the first segment to implement the determined security response action to control a flow of data traffic to or from the first segment, wherein determining the security response action to implement comprises:
• performing a trend analysis on the status metrics for the first segment and applying results of the trend analysis to a plurality of rules associated with corresponding security response action indicators, and
• automatically selecting a security response action based on a rule in the plurality of rules whose criteria are met by the results of the trend analysis and other characteristics of at least one of the first attack or second attack.