US 2016/0080408 A1Published application

Apparatuses, methods and systems for a cyber security assessment mechanism

OwnerChristopher D. Coleman, Allan Thomson +1inventors

InventorsChristopher D. Coleman, Allan Thomson, Jason A. Lewis

Life of this patent

Estimating the term…

Loading patent…

Abstract

The cyber security assessment mechanism system is disclosed, including a first cyber threat intelligence processing component to calculate a cyber threat indicator confidence score associated with at least one of a cyber threat indicator or a network element after the cyber threat indicator is received. The cyber security assessment further includes a cyber security index component to generate a cyber threat index value for the cyber network based on the cyber threat indicator confidence score associated with the network elements after the cyber threat indicator confidence score is associated. The cyber security index component further sends the cyber threat index value for the cyber network, to a second cyber threat intelligence processing component disposed at a remote location from the data center such that the second cyber threat processing component generates a user interface visualization representing the cyber threat index value.

Claims23

Dependent claims

A system, comprising:

a first cyber threat processing component, implemented in at least one of a first processor or a first memory and disposed at a network-accessible compute device within a first cyber network that includes a second cyber network and a third cyber network,
the first cyber threat processing component calculates a threat indicator confidence score associated with at least one of a cyber threat indicator or associated with a network element after the cyber threat indicator is received;
and
a cyber security index component implemented in at least one of a second processor or a second memory, the cyber security index component disposed at the data center, communicatively coupled to the first cyber threat processing component,
the cyber security index component associates the threat indicator confidence score with a network element of the first cyber network based on network topology information of the first cyber network after the network topology information is obtained,
the cyber security index component generates a threat index for the first cyber network based on the threat indicator confidence score associated with the network element after the threat indicator confidence score is associated with the network element;
the cyber security index component sends a first and second local representation of the first cyber network including the threat index for the first cyber network, after the threat index is generated, to at least a second cyber threat processing component disposed at a location remote from the data center and in the second cyber network and a third cyber threat processing component disposed at a location remote from the data center and in the third cyber network, such that the second cyber threat processing component receives the first local representation of the first cyber network and generates a user interface visualization displaying the first local representation of the first cyber network, and the third cyber threat processing component receives the second local representation of the first cyber network and generates a user interface visualization displaying the second local representation of the first cyber network;
the first cyber threat processing component configured to receive a first cyber health assessment characteristic modification of the first local representation of the first cyber network from the second cyber threat processing component and a second cyber health assessment characteristic modification of the second local representation of the first cyber network from the third cyber threat processing component;
and
the first cyber threat processing component configured to merge the first cyber health assessment characteristic modification and the second cyber health assessment characteristic modification and modify the threat indicator confidence score based on the merged first cyber health assessment characteristic modification and the second cyber health assessment characteristic modification.

7 more elements

A processor-implemented method, comprising:

receiving a cyber threat indicator;
calculating, via a processor, a threat indicator confidence score associated with the cyber threat indicator;
obtaining network topology information of a first cyber network including at least a second cyber network and a third cyber network,
associating the threat indicator confidence score with at least one network element of the first cyber network based on the network topology information;
generating a threat index for the first cyber network based on the threat indicator confidence score associated with the at least one network element;
sending a communication message including a first local representation of the first cyber network that includes the threat index and identifying information of the local representation of the first cyber network to a first client compute device;
receiving, via a first cyber threat processing component, a first cyber health assessment element modification of the first local representation of the first cyber network from the first client compute device;
merging the first cyber health assessment element modification of the first local representation of the first cyber network with a second cyber health assessment element modification of a second local representation of the first cyber network received from a second client compute device;
and
modifying, via the first cyber threat processing component, the threat indicator confidence score based on the merged first cyber health assessment element modification of the first local representation of the first cyber network and second cyber health assessment element modification of the second local representation of the first cyber network.

7 more elements

A non-transitory processor-readable medium storing code presenting processor-executable instructions, the code comprising code to cause the processor to:

receive a communication message including a local representation of a first cyber network that identifies information of the first cyber network and includes a threat index that was generated at a cyber threat network-accessible compute device based on network topology information of the first cyber network and a threat indicator confidence score associated with at least one of a cyber threat indicator or a network element in the first cyber network, the first cyber network including at least a second cyber network and a third cyber network;
generate an interactive user interface having a visualization of the local representation of the first cyber network;
receive, via the interactive user interface, a user input indication representing a modification of the threat indicator confidence score of the local representation of the first cyber network, in response to generating the interactive user interface having the visualization of the local representation of the first global cyber network;
modify the threat index associated with the network element of the local representation of the first cyber network based on the user input indication;
send the modified threat index to a cyber security index component remote from the interactive user interface;
and
dynamically adjust the visualization of the local representation of the first cyber network using an updated threat index received from the cyber security index component and calculated based on a modified threat indicator confidence score updated by the modified threat index.

4 more elements

Dependencies are inferred from the claim text.