Enhanced network security

• US 8,904,526 B2
• Filed: 11/20/2012
• Issued: 12/02/2014
• Est. Priority Date: 11/20/2012
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Deb, Subhajit, Chopra, Anil, Shukla, Kedarnath
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US13/681,557
• Publication Number:
  US 20140143863A1
• Time in Patent Office: 742 Days
• Field of Search: 726 21- 25, 726/26, 713/166, 713/167, 713/193, 715/234, 715/215
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system may receive a plurality of security threats and categorize each security threat in the plurality of security threats into security threat categories. The system may then determine, based at least in part upon an instance of a security threat category, a future occurrence of the security threat category and determine, based at least in part upon the future occurrence of the security threat category, that the security threat category is an emerging threat.

Claims

1. A method comprising:

receiving a plurality of security threats;

categorizing, by a processor, each security threat in the plurality of security threats into a security threat category of a plurality of security threat categories;

determining, by the processor, based at least in part upon a first past occurrence of a first security threat category of the plurality of security threat categories and disregarding a second past occurrence of the first security threat category, that a number of occurrences of the first security threat category has increased;

in response to the determination that the number of occurrences of the first security threat category has increased, determining, by the processor, based at least in part upon an instance of a second security threat category of the plurality of security threat categories and based at least in part upon a date associated with a past occurrence of the first security threat category, that the number of occurrences of the first security threat category will continue to increase;

in response to the determination that the number of occurrences of the first security threat category will continue to increase, determining, by the processor, based at least in part upon a threshold, that the first security threat category is an emerging threat, wherein the threshold is based at least in part upon the first past occurrence of the first security threat category;

determining, by the processor, a management priority for the first security threat category;

determining, by the processor, based at least in part upon a past occurrence of the second security threat category, that a number of occurrences of the second security threat category has plateaued;

in response to the determination that the number of occurrences of the second security threat category has plateaued, determining, by the processor, that the number of occurrences of the second security threat category will decrease; and

determining, by the processor, based at least in part upon a past occurrence of a third security threat category of the plurality of security threat categories, that an instance of a fourth security threat category will occur.

2. The method of claim 1, further comprising communicating a message indicating that the first security threat category is an emerging threat.

3. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

receive a plurality of security threats;

categorize each security threat in the plurality of security threats into a security threat category of a plurality of security threat categories;

determine, based at least in part upon a first past occurrence of a first security threat category of the plurality of security threat categories and disregarding a second past occurrence of the first security threat category, that a number of occurrences of the first security threat category has increased;

in response to the determination that the number of occurrences of the first security threat category has increased, determine, based at least in part upon an instance of a second security threat category of the plurality of security threat categories and based at least in part upon a date associated with a past occurrence of the first security threat category, that the number of occurrences of the first security threat category will continue to increase;

in response to the determination that the number of occurrences of the first security threat category will continue to increase, determine, based at least in part upon a threshold, that the first security threat category is an emerging threat, wherein the threshold is based at least in part upon the first past occurrence of the first security threat category;

determine a management priority for the first security threat category;

determine, based at least in part upon a past occurrence of the second security threat category, that a number of occurrences of the second security threat category has plateaued;

in response to the determination that the number of occurrences of the second security threat category has plateaued, determine that the number of occurrences of the second security threat category will decrease; and

determine, based at least in part upon a past occurrence of a third security threat category of the plurality of security threat categories, that an instance of a fourth security threat category will occur.

4. The media of claim 3 embodying software that is further operable when executed to communicate a message indicating that the first security threat category is an emerging threat.

5. A system comprising:

a memory; and

a processor communicatively coupled to the memory and configured to;

receive a plurality of security threats;

categorize each security threat in the plurality of security threats into a security threat category of a plurality of security threat categories;

determine, based at least in part upon a first past occurrence of a first security threat category of the plurality of security threat categories and disregarding a second past occurrence of the first security threat category, that a number of occurrences of the first security threat category has increased;

in response to the determination that the number of occurrences of the first security threat category has increased, determine, based at least in part upon an instance of a second security threat category of the plurality of security threat categories and based at least in part upon a date associated with a past occurrence of the first security threat category, that the number of occurrences of the first security threat category will continue to increase;

in response to the determination that the number of occurrences of the first security threat category will continue to increase, determine, based at least in part upon a threshold, that the first security threat category is an emerging threat, wherein the threshold is based at least in part upon the first past occurrence of the first security threat category;

determine a management priority for the first security threat category;

determine, based at least in part upon a past occurrence of the second security threat category, that a number of occurrences of the second security threat category has plateaued;

in response to the determination that the number of occurrences of the second security threat category has plateaued, determine that the number of occurrences of the second security threat category will decrease; and

determine, based at least in part upon a past occurrence of a third security threat category of the plurality of security threat categories, that an instance of a fourth security threat category will occur.

6. The system of claim 5 wherein the processor is further configured to communicate a message indicating that the first security threat category is an emerging threat.