System and method for dynamically updating existing threat models based on newly identified active threats

A method comprising:

• monitoring a database comprising data associated with a known security threat at a regular interval to determine whether the database receives data associated with a new security threat, wherein the data associated with the known security threat comprises a first description associated with the known security threat, wherein the data associated with the new security threat comprises a new description associated with the new security threat;
• in response to determining that the new security threat is added to the database, the method further comprises:
• extracting, based on natural language processing of the first description, information associated with the first description;
• extracting, based on natural language processing of the new description, information associated with the new description;
• determining, based on a comparison of the information associated with the first description and the information associated with the new description, that the new security threat does not correspond to the known security threat in the database;
• in response to determining that the new security threat does not correspond to the known security threat in the database, the method further comprises:
• identifying, based on natural language processing of the new description associated with the new security threat, one or more attributes of software susceptible to the new security threat;
• identifying, based on natural language processing of a threat model associated with a software application, one or more attributes of the software application;
• determining, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application, that the software application is susceptible to the known security threat;
• and
• in response to determining that the software application is susceptible to the new security threat, updating the threat model to reflect the susceptibility of the software application to the new security threat.

A non-transitory computer-readable medium comprising instructions that, when executed by a hardware processor, cause the processor to:

• monitor a database comprising data associated with a known security threat at a regular interval to determine whether the database receives data associated with a new security threat, wherein the data associated with the known security threat comprises a first description associated with the known security threat, wherein the data associated with the new security threat comprises a new description associated with the new security threat;
• in response to determining that the new security threat is added to the database, the instructions when executed by the processor, cause the processor to:
• extract, based on natural language processing of the first description, information associated with the first description;
• extract, based on natural language processing of the new description, information associated with the new description;
• determine, based on a comparison of the information associated with the first description and the information associated with the new description, that the new security threat does not correspond to the known security threat in the database;
• in response to determining that the new security threat does not correspond to the known security threat in the database, the instructions when executed by the processor, cause the processor to:
• identify, based on natural language processing of the new description associated with the new security threat, one or more attributes of software susceptible to the new security threat;
• identify, based on natural language processing of a threat model associated with a software application, one or more attributes of the software application;
• determine, based on a comparison between the one or more attributes of software susceptible to the new security threat and the one or more attributes of the software application, that the software application is susceptible to the new security threat;
• and
• in response to determining that the software application is susceptible to the new security threat, update the threat model to reflect the susceptibility of the software application to the known security threat.