System and method for scaled management of threat data

A computer system for managing threats to a network, comprising:

• a memory configured to store instructions;
• processor disposed in communication with said memory, wherein said processor upon execution of the instructions is configured to:
• receive volume threat data that indicates a volume of threat data that needs to be managed by a threat management system having a plurality of threat management devices;
• determine a volume range from a plurality of volume ranges to which the received volume threat data belongs;
• determine a number of threat management devices of the plurality of threat devices needed to manage threat traffic associated with the volume range determined;
• determine whether the number of threat management devices needed is different than a number of threat management devices currently being used to manage threat traffic;
• select automatically threat management devices of the plurality of threat management devices to manage received threat data, in response to a determination that the number is different and based on the number determined;
• assign automatically, each packet of the threat traffic to a group, each group corresponding to a threat management device of the selected threat management devices;
• and
• direct automatically each packet of the threat traffic to the threat management device that corresponds to the group to which the packet is assigned.

A non-transitory computer readable storage medium and one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

• receive volume threat data that indicates a volume of threat data that needs to be managed by a threat management system having a plurality of threat management devices;
• determine a volume range from a plurality of volume ranges to which the received volume threat data belongs;
• determine a number of threat management devices of the plurality of threat devices needed to manage threat traffic associated with the volume range determined;
• determine whether the number of threat management devices needed is different than a number of threat management devices currently being used to manage threat traffic;
• select automatically threat management devices of the plurality of threat management devices to manage received threat data, in response to a determination that the number is different and based on the number determined;
• assign automatically, each packet of the threat traffic to a group, each group corresponding to a threat management device of the selected threat management devices;
• and
• direct automatically each packet of the threat traffic to the threat management device that corresponds to the group to which the packet is assigned.