Cybersecurity automated threat intelligence and attack mitigation system

A method of protecting Monitored Systems comprising the steps of:

• a. preloading the Search Term Storage with vulnerability search terms indicating vulnerabilities of system architectures and search terms indicative of different types of cybersecurity attacks;
• b. downloading and storing cybersecurity articles describing cybersecurity attacks and related information, (“past articles”) from a source into a Raw Storage;
• c. acquiring and storing a System Hardware Analyzer Architecture Information of the Monitored Systems in a Systems Architecture Storage;
• d. reviewing the past articles, and selecting a small number of them (“example attack articles”) through a User Interface interacting with a SysAdmin, as indicative of various types of cybersecurity attacks;
• e. identifying articles (selected attack articles) similar to the example attack articles in the past articles;
• f. extracting unique search terms for each type of cybersecurity attack from the example attack articles and selected articles by a Search Term Extractor;
• and
• g. storing the unique search terms for each type of attack in a Search Term Storage;
• h. selecting example vulnerability articles from the past articles that indicate vulnerability,
• i. searching for articles (“selected vulnerability articles”) similar to the example vulnerability articles;
• j. extracting unique search terms for vulnerability from example vulnerability articles and the selected vulnerability articles;
• k. storing the extracted search terms in the Search Term Storage;
• l. Identifying the hardware, software, and systems configurations of the Monitored Systems;
• and
• m. storing this information in a System Architecture Storage;
• n. accepting a newly-received online article (“live article”) relating to cybersecurity;
• o. identifying any terms in the live article similar to vulnerability search terms and if found, extract vulnerability information from the live article;
• p. identifying any terms in the live article similar to malware search terms and if found, extract malware information from the Live articles;
• q. identifying any terms in the live article similar to data breach search terms and if found, extract data breach information from the live article;
• r. identifying any terms in the live article similar to DDoS search terms and, if found, extract DDoS information from the live article;
• s. if criticality is above a threshold, then immediately send extracted information to SysAdmin;
• t. if criticality is above a second threshold, then send extracted information to a previously determined responsible person;
• u. sending a notification through a Communication Device, via available technologies to the contact person previously assigned to each hardware device, software element, and system configuration of any vulnerabilities or possible cybersecurity attacks identified in the live articles.

An Automated Cybersecurity System for monitoring and mitigating effects of a cybersecurity attack on monitored systems comprising:

• a. a System Hardware Analyzer that keeps a current listing of the hardware, software, and systems configuration (“Elements”) of each of the monitored systems;
• b. a Receiver that reads online news articles, RSS feeds and other cybersecurity notices (current articles);
• c. a Vulnerability Identifier with access to preloaded vulnerability search terms that reviews the Current Articles to identify and select Vulnerability Articles highly related to the Elements of at least one of the Monitored Systems;
• d. a Classifier with access to preloaded, malware data breach and Distributed Denial of Service (DDoS) Search Terms;
• e. wherein the Classifier reviews current articles to identify if they correlate with the malware data breach and Distributed Denial of Service (DDoS) search terms, and activates the appropriate analyzer;
• f. a Malware Analyzer is activated if the Classifier indicates that the live article correlates with a malware attack and extracts malware information and criticality from the live article;
• g. a Data Breach Analyzer is activated if the Classifier indicates that the live article correlates with a data breach attack and extracts data breach formation and criticality from the live article and
• h. a DDoS Analyzer is activated if the Classifier indicates that the live article correlates with a DDoS attack and extracts DDoS information and criticality from the Live Article;
• i. a Vulnerability Identifier receives predetermined vulnerability search terms and the Elements of the Monitored System and analyzes the Live Article to identify if vulnerability information indicating elements of the Monitored Systems has vulnerabilities;
• j. an Article Summarizer is coupled to the Malware Analyzer, the Data Breach Analyzer, and the DDoS Analyzer, and the Vulnerability Identifier, receives the malware, data breach, and DDoS information, as well as Vulnerability Information and creates a summary and notifies a SysAdmin if the criticality is above a first threshold;
• k. a Communication Device is coupled to the Vulnerability Identifier and receives preloaded contact information for a responsible person for each element of the Monitored Systems which was identified as being vulnerable, and notifies each responsible person.