Distributed threat management

A system for managing a security threat in a distributed system, comprising:

• a plurality of distributed elements, including a plurality of distributed threat detection sources, the distributed elements being arranged to send reports of detected suspicious activity;
• and
• a threat management agent for receiving the reports of detected suspicious activity from the distributed elements and determining whether an attack is taking place.

A system for managing a security threat in a distributed system, comprising:

• a threat management agent for reviewing the reports of suspicious activity to determine, based on the reports, whether a pattern characteristic of an attack occurred and for predicting when a next attack is likely to occur, the threat management agent being further for directing deployment of a countermeasure to the predicted next attack, in a time window based on when the next attack is predicted to occur.

A threat management agent for managing a security threat in a distributed system, the threat management agent comprising:

• an activity receiver for receiving reports of suspicious activity from a distributed element of the system;
• and
• an attack determiner for determining whether an attack is taking place.

A threat management agent for managing a security threat in a distributed system, the threat management agent comprising:

• an attack predictor for reviewing reports of suspicious activity, the reports including suspicious activity reported from at least one distributed element of the distributed system, and for determining whether a pattern characteristic of an attack occurred and for predicting when a next attack is likely to occur based on the detected pattern;
• a director for directing deployment of a countermeasure to the predicted next attack, in a time window based on when the next attack is predicted to occur.

A distributed element of a system for managing a security threat, the distributed element comprising:

• a countermeasure deployer for deploying a countermeasure responsive to receiving a message from a threat management agent directing that the countermeasure be activated, the threat management agent configured to receive reports of suspicious activity from at least one other distributed element.

A machine-readable medium having instructions recorded thereon, such that when the instructions are read and executed by a processor, the processor is configured to perform:

• receiving reports of suspicious activity from a distributed element of a system;
• and
• determining whether an attack is taking place based on the received reports.