A system connected to a plurality of security products via a network for activating one of the plurality of security products based on selecting the one based on a comparative scoring evaluation of each of the plurality of security products provided by a corresponding a plurality of vendors, comprising:
- a network interface layer communicatively interposed between a security stack and the plurality of security products comprising a plurality of drivers,
- wherein the plurality of drivers includes at least one driver for each of the plurality of security products, wherein at least two of the plurality of drivers is each assigned to only one of each of two of the plurality of security products, and
- wherein each of the plurality of drivers is configured for communications with a corresponding matched one of the plurality of security products for providing communications between the plurality of security products and the security stack by accommodating different forms of communication standards and different interfaces correspondingly associated with the plurality of vendors and correspondingly implemented by the plurality of security products, processing circuitry;
- and
- memory containing instructions that when executed by the processing circuitry cause the system to:
- configure the security stack to protect a protected entity from a plurality of threats, each threat belonging to one of a plurality of threat categories, by orchestrating operations of the plurality of security products deployed to provide protection for the protected entity such that only one of the plurality of security products is activated at a given time to perform the protection,
- each of the plurality of security products configured to:
- communicate information including attack logs identifying malicious and non-malicious activity on the network, and
- maintain an attack database including security rules;
- the security stack comprising a plurality of layers wherein each layer is communicatively interconnected through one or more APIs, the plurality of layers comprising:
- a classifier layer, and
- a security services layer,
- wherein:
- the classifier layer is communicatively interposed between the network interface layer and the security services layer, the classifier layer comprising a plurality of classifiers, wherein each classifier of the plurality of classifiers is configured to classify during runtime portions of the security rules from the plurality of the maintained attack databases and portions of the communicated attack logs into a unified representation of normalized security rules and normalized attack logs by extracting, from information received from the plurality of security products, corresponding portions of the received information from each of the plurality of security products into a corresponding one of the plurality of threat categories, and
- wherein the extracted received information from the each classifier is routed to the security services layer in accordance with the corresponding one of the plurality of threat categories in a form corresponding to one of the unified representations classified by the plurality of classifiers,
- the security services layer communicatively interconnected through one or more APIs to the classifier layer and comprising a plurality of security services wherein each security service of the plurality of security services corresponds to one of the pluralities of threat categories, the plurality of security services comprising one or more security engines, and one or more profiles, each profile corresponding to a corresponding one of the unified representations and to a corresponding security product of the plurality of security products, and
- wherein each of the one or more security engines:
- using at least a portion of the routed information, generates a performance score for each of the one or more profiles as a measure of an efficacy of the each of the one or more profiles for handling each of the plurality, of threat categories, and
- collects each of the generated performance scores with
- a corresponding of the each of the one or more profiles,
- evaluate the collection to select a security product from the plurality of security products that is most capable of effectively handling the plurality of threats;
- and
- activate over the network the selected security product to protect the protected entity and to be the only security product of the plurality of security products to be actively protecting the protected entity.