Mapping an attack tree and attack prediction in industrial control and iiot environment using hash data analytics

An apparatus configured to detect malicious content and predict attacks in an industrial control system, the apparatus comprising at least one processor and at least one non-transitory memory including program code, the at least one non-transitory memory and the program code configured to, with the processor, cause the apparatus to at least:

• receive a hash query from a secure media exchange node, wherein the hash query comprises a file hash generated at the secure media exchange node based at least in part on one or more files received at the secure media exchange node;
• query a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files by comparing the hash query with file hashes stored in the cyberattack case studies information database;
• generate a file security analysis regarding the one or more files based on the one or more attack correlation information items;
• and
• output the file security analysis to a secure media exchange threat intelligence portal associated with the secure media exchange node for authorization of the one or more files.

A computer program product comprising at least one non-transitory computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising an executable portion configured to:

• receive a hash query from a secure media exchange node, wherein the hash query comprises a file hash generated at the secure media exchange node based at least in part on one or more files received at the secure media exchange node;
• query a cyberattack case studies information database based on the hash query to generate one or more attack correlation information items associated with at least one of the one or more files by comparing the hash query with file hashes stored in the cyberattack case studies information database;
• generate a file security analysis regarding the one or more files based on the one or more attack correlation information items;
• and
• output the file security analysis to a secure media exchange threat intelligence portal associated with the secure media exchange node for authorization of the one or more files.