CREATING A SECURITY REPORT FOR A CUSTOMER NETWORK

• US 20170214711A1
• Filed: 07/31/2014
• Published: 07/27/2017
• Est. Priority Date: 07/31/2014
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Arnell, Simon Ian, Passingham, Neil, Mont, Marco Casassa
• Application Number:
  US15/500,397
• Publication Number:
  US 20170214711A1
• Time in Patent Office: Days
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Creating a security report for a customer network includes obtaining from a customer network, security information about the customer network, preparing, based on modification rules, the security information to create modified security information, analyzing, based on big data threat analytics, the security threats to create a number of metrics, refining the number of metrics using a refining model, creating, based on the refined number of metrics used as an input for model-based predictive analytics and the security threats, a security report representing security intelligence for the customer network in which the number of metrics are refined by a refining model and used as an input for the model-based predictive analytics.

Claims

1. A method for creating a security report for a customer network, the method comprising:

obtaining, from a customer network, security information about the customer network;

preparing, based on modification rules, the security information to create modified security information;

analyzing, via big data threat analytics, the modified security information to create a number of metrics and identify security threats;

refining the number of metrics using a refining model; and

creating, based on the refined number of metrics used as an input for model-based predictive analytics and the security threats, a security report the security report representing security intelligence for the customer network.

2. The method of claim 1, in which the security information comprises unstructured data, events related to the customer network, or combinations thereof.

3. The method of claim 1, in which the model-based predictive analytics identifies the security threats for vulnerability and threat management (VTM), identify and access management (IAM), incident and remediation management (IRM), or combinations thereof.

4. The method of claim 1, in which the security report comprises a historical report, a benchmarking report, or combinations thereof for the customer network.

5. The method of claim 1, further comprising storing the modified security information in a repository for a long term analysis by the big data threat analytics.

6. The method of claim 1, in which the big data threat analytics calculates statistics, identifies new security threats based on predefined threat indicators, translates the statistics and the new security threats into the number of metrics, analyzes the security threats, or combinations thereof.

7. A system for creating a security report for a customer network, the system comprising:

an obtaining engine to obtain, from a customer network, security information about the customer network;

a preparing engine to prepare, based on modification rules, the security information to create modified security information;

a storing engine to store the modified security information in a repository for a long term analysis by a big data threat analytics;

an analyzing engine to analyze, via the big data threat analytics, the modified security information to create a number of metrics and identify security threats;

a refining engine to refine the number of metrics using a refining model; and

a creating engine to create, based on the refined number of metrics used as an input for model-based predictive analytics and the security threats, a security report representing security intelligence for the customer network.

8. The system of claim 7, in which the security information comprises unstructured data, events related to the customer network, or combinations thereof.

9. The system of claim 7, in which the model-based predictive analytics identifies the security threats for vulnerability and threat management (VTM), identify and access management (IAM), incident and remediation management (IRM), or combinations thereof.

10. The system of claim 7, in which the security report comprises a historical report, a benchmarking report, or combinations thereof for the customer network.

11. The system of claim 7, in which the big data threat analytics calculates statistics, identifies new security threats based on predefined threat indicators, translates the statistics and the new security threats into the number of metrics, analyzes the security threats, or combinations thereof.

12. A computer program product for creating a security report for a customer network, comprising:

a tangible computer readable storage medium, said tangible computer readable storage medium comprising computer readable program code embodied therewith, said computer readable program code comprising program instructions that, when executed, causes a processor to;

prepare, based on modification rules, security information to create modified security information;

analyze, via big data threat analytics, the modified security information to create a number of metrics and identify security threats;

refine the number of metrics using a refining model; and

create, based on the refined number of metrics used as an input for model-based predictive analytics and the security threats, a security report representing security intelligence for the customer network.

13. The product of claim 12, further comprising computer readable program code comprising program instructions that, when executed, cause said processor to obtain, from the customer network, the security information about the customer network.

14. The product of claim 12, further comprising computer readable program code comprising program instructions that, when executed, cause said processor to store the modified security information in a repository for a long term analysis by the big data threat analytics.

15. The product of claim 12, in which the model-based predictive analytics identifies the security threats for vulnerability and threat management (VTM), access management (IAM), incident and remediation management (IRM), or combinations thereof and in which the big data threat analytics calculates statistics, identifies new security threats based on predefined threat indicators, translates the statistics and the new security threats into the number of metrics, analyzes the security threats, or combinations thereof.