Domain Specific Language for Defending Against a Threat-Actor and Adversarial Tactics, Techniques, and Procedures

A computer program product comprising a non-transitory computer useable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing device processors to:

• determine a framework based on an attack repository, the attack repository comprising attack data captured from multiple computing devices associated with different entities, the attack data comprising one or more of:
• a plurality of attack execution operations,
• one or more attackers associated with the plurality of attack execution operations, and
• one or more resources associated with the plurality of attack execution operations,
• determine a first primitive based on the framework, the first primitive comprising:
• a first identifier defining a first attack execution operation comprised in the plurality of attack execution operations,
• a first descriptor indicating an attack type associated with the first attack execution operation,
• a second descriptor indicating a vulnerability type associated with the first attack execution operation,
• a third descriptor indicating a stability parameter associated with the first attack execution operation,
• a fourth descriptor indicating intensity data associated with the first attack execution operation,
• determine a second primitive based on the framework, the second primitive indicating one or more defense information associated with the first attack execution operation, the second primitive comprising at least a first defense step associated with at least one resource comprised in the one or more resources associated with the plurality of attack, the first defense step comprising:
• a second identifier defining the first defense step, and
• a parameter indicating a security measure for defending against the first attack execution operation, and
• combine the first primitive and the second primitive into a domain specific language (DSL) file that defends against the first attack execution operation, the DSL file being useable to generate binaries executable within a specific domain, such that a security system outside the specific domain cannot execute the DSL file.

A system comprising:

• one or more computing system processors;
• and
• memory storing instructions that, when executed by the one or more computing system processors, causes the system to:
• determine a framework based on an attack repository, the attack repository comprising attack data captured from multiple computing devices associated with different entities, the attack data comprising one or more of:
• a plurality of attack execution operations,
• one or more attackers associated with the plurality of attack execution operations, or
• one or more resources associated with the plurality of attack execution operations,
• determine a first primitive based on the framework, the first primitive comprising:
• a first identifier defining a first attack execution operation comprised in the plurality of attack execution operations,
• a first descriptor indicating an attack type associated with the first attack execution operation,
• a second descriptor indicating a vulnerability type associated with the first attack execution operation,
• a third descriptor indicating a stability parameter associated with the first attack execution operation,
• a fourth descriptor indicating intensity data associated with the first attack execution operation,
• determine a second primitive based on the framework, the second primitive indicating one or more defense information associated with the first attack execution operation, the second primitive comprising at least a first defense step associated with at least one resource comprised in the one or more resources associated with the plurality of attack, the first defense step comprising:
• a second identifier defining the first defense step, and
• a parameter indicating a security measure for defending against the first attack execution operation, and
• combine the first primitive and the second primitive into a file that defends against the first attack execution operation, the file being useable to generate binaries executable within a specific domain, such that a security system outside the specific domain cannot execute the file.