Security threat management framework

Patent metadata

Field	Value
Publication number	US-11228619-B2
Application number	US-202016855103-A
Country	US
Kind code	B2
Filing date	Apr 22, 2020
Priority date	Apr 22, 2020
Publication date	Jan 18, 2022
Grant date	Jan 18, 2022

Abstract

A method, apparatus and computer program product for managing security threats to a distributed network. A set of events are aggregated from a plurality of event sources in the network for each of a set of security threats to the network. A magnitude of a characteristic of each of the set of security threats is determined. Each of the set of security threats is represented as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic. A security action is taken based on the determined magnitude of one of the set of security threats.

First claim

Having described our invention, what we now claim is as follows:

1. A method for managing security threats to a distributed network comprising:
aggregating events from a plurality of event sources in the network for each of a set of security threats to the network;
determining a magnitude of a characteristic of each of the set of security threats;
representing ones of the set of security threats having a magnitude of the characteristic greater than a threshold as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic; and
facilitating a security action based on the determined magnitude of one of the set of security threats.

2. The method as recited in claim 1 , wherein the 3D dimensional graphical object of each of the set of security threats is a threat well, the characteristic is a severity of the security threat and a relative severity of the security threat is depicted as a displacement of the threat well from a planar interface object representing a network.

3. The method as recited in claim 1 , wherein a respective threat well can be selected to list a set of events of the distributed network associated with the security threat represented by the threat well.

4. The method as recited in claim 1 , wherein respective dimensions of the threat wells dynamically expand and contract to reflect a respective current severity of the set of security threats based on new events and decay freshness of old events aggregated to the security threat.

5. The method as recited in claim 1 , wherein the 3D dimensional graphical object of each of the set of security threats is a threat well and displayed mass pair, wherein a dimension of the threat well represents a first characteristic of the security threat and a dimension of the displayed mass represents a second characteristic of the security threat.

6. The method as recited in claim 4 , wherein a first decay factor for a 3D dimensional graphical object of a security threat that has been remediated by a user is different than a second decay factor for a 3D dimensional representation of a security threat that has been not been remediated by a user.

7. The method as recited in claim 4 , wherein a decay process for a 3D dimensional graphical object of a security threat begins according to a creation time of the for a 3D dimensional graphical object of a security threat and the decay process is reset responsive to a new event received after the creation time being assigned to the security threat.

8. The method as recited in claim 1 , wherein a 3D dimensional representation for a security threat is a cluster of a plurality of 3D dimensional representations, a dimension of each of the plurality of 3D dimensional representations is representative of a magnitude of a respective characteristic of the respective security threats and the security threats have similar sets of high value events.

9. Apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor for managing security threats to a distributed network, the computer program instructions comprising:
program code, operative to aggregate events from a plurality of event sources in the network for each of a set of security threats to the network;
program code, operative to determine a magnitude of a characteristic of each of the set of security threats;
program code, operative to represent ones of the set of security threats having a magnitude of the characteristic greater than a threshold as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic; and
program code, operative to facilitating a security action based on the determined magnitude of one of the set of security threats.

10. The apparatus as recited in claim 9 , further comprising:
event adapter code, operative to receive events from a type of event source wherein the event adapter code normalizes events received from the event source to a format for the aggregating code.

11. The apparatus as recited in claim 10 , wherein the event sources comprise a plurality of different security applications which monitor different security aspects of the network and the event adapter code comprises a different adapter for each type of security application.

12. The apparatus as recited in claim 10 , wherein the event adapter code determines whether a respective event is a high value event and only forwards high value events to the aggregating code, wherein only high value events are used for creating a threat well.

13. The apparatus as recited in claim 10 , wherein the event adapter code determines a severity of an event based on an event payload.

14. The apparatus as recited in claim 9 , wherein the characteristic is a severity of the security threat and the severity is established by the aggregating code based on an event count associated with the security threat, a credibility of security threat information, a relevance of events to the security threat directed at a set of aggregated assets, and an importance of the set of assets to an organization.

15. A computer program product in one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the computer program product holding computer program instructions executed by the data processing system for managing security threats to a distributed network, the computer program instructions comprising:
program code, operative to aggregate events from a plurality of event sources in the network for each of a set of security threats to the network;
program code, operative to determine a magnitude of a characteristic of each of the set of security threats;
program code, operative to represent ones of the set of security threats having a magnitude of the characteristic greater than a threshold as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic; and
program code, operative to facilitating a security action based on the determined magnitude of one of the set of security threats.

16. The computer program product as recited in claim 15 , wherein a 3D dimensional representation for a security threat has a set of dimensions and each of the set of dimensions is representative of a magnitude of a respective characteristic of the security threat.

17. The computer program product as recited in claim 15 , wherein a 3D dimensional representation for a security threat has a set of features and a color of one of the set of representative is representative of a magnitude of a respective characteristic of the security threat.

18. The computer program product as recited in claim 16 , wherein a set of three dimensional graphical objects in a three dimensional (3D) representation of the network are clustered according to a similarity of security threats represented by the 3D graphical objects based on a similarity of events associated with respective 3D graphical objects.

19. The computer program product as recited in claim 15 , further comprising:
program code, operative to determine a creation time of a first three dimensional graphical object representing a first security threat;
program code, operative to determine whether a remediation action has been taken to remediate the first security threat;
program code, operative to establish a d

Assignees

• IBM
• Int Busuness Machines Corporation

Inventors

• Couturier Russell
• Flood Jason
• Butler Aidan
• Tackabury Wayne F
• Hourigan Patrick

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title