Centralized threat intelligence

At least one non-transitory machine-readable medium including instructions for centralized security threat detection that, when executed by at least one processor, cause the at least one processor to perform operations to:

• obtain a first entity privacy ruleset for a first threat data source of a first entity;
• obtain an anonymized set of threat data from a first threat data source by processing threat data from the first threat data source by filtering confidential data from the threat data using a set of privacy rules from the first entity privacy ruleset;
• populate a threat database with the anonymized set of threat data, wherein the threat data includes characteristics of security threats;
• receive a registration request for a user of a device;
• assign a unique user identifier for the user and a unique device identifier for the device;
• generate a threat model for the unique user identifier and unique device identifier based on a set of the characteristics from the threat database that correspond to the user and the device;
• receive a set of data access attributes for a data access request initiated with the unique user identifier and the unique device identifier for data from a data source of a second entity, the set of data access attributes anonymized using a second entity privacy ruleset for the second entity;
• block the data access request based on an evaluation of the data access attributes using the threat model;
• and
• update the threat database with the anonymized data access attributes.

A method for centralized security threat detection comprising:

• obtaining a first entity privacy ruleset for a first threat data source of a first entity;
• obtaining an anonymized set of threat data from a first threat data source by processing threat data from the first threat data source by filtering confidential data from the threat data using a set of privacy rules from the first entity privacy ruleset;
• populating a threat database with the anonymized set of threat data, wherein the threat data includes characteristics of security threats;
• receiving a registration request for a user of a device;
• assigning a unique user identifier for the user and unique device identifier for the device;
• generating a threat model for the unique user identifier and a unique device identifier using a set of the characteristics from the threat database that correspond to the user and the device;
• receiving a set of data access attributes for a data access request initiated using the unique user identifier and the unique device identifier for data from a data source of a second entity the set of data access attributes anonymized using a second entity privacy ruleset for the second entity;
• blocking the data access request based on an evaluation of the data access attributes using the threat model;
• and
• updating the threat database with the anonymized data access attributes.