Assessing threat to at least one computer network

• US 9,288,224 B2
• Filed: 08/17/2015
• Issued: 03/15/2016
• Est. Priority Date: 09/01/2010
• Status: Active Grant

• Current Assignee: Quantar Solutions Limited
• Original Assignee: Quantar Solutions Limited
• Inventors: King-Wilson, Phillip
• Primary Examiner(s): Edwards, Linglan
• Assistant Examiner(s): GRACIA, GARY S
• Application Number:
  US14/827,712
• Publication Number:
  US 20150358341A1
• Time in Patent Office: 211 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Apparatus for assessing threat to at least one computer network in which a plurality of systems (30₁, 30₂, 30₃, 30₄, 30₅, . . . 30_n) operate is configured to determine predicted threat activity (13), to determine expected downtime of each system in dependence upon said predicted threat activity, to determine loss (12_A, 12_B, 12_C, 12_D, 12_E, . . . , 12_m) for each of a plurality of operational processes (31_A, 31_B, 31_C, 31_D, 31_E, . . . 31_m dependent on the downtimes of the systems, to add losses for the plurality of processes so as to obtain a combined loss (12_SUM) arising from the threat activity.

Claims

1. Apparatus for assessing and valuing computer network threats, the threats including at least one electronic threat, the computer network comprising a plurality of IT systems and a plurality of business processes operating on the plurality of IT systems, the apparatus comprising at least one processor and a memory coupled to the processor, the memory storing instructions executable by the processor that cause the processor to:

predict future threat activity based on past observed threat activity including, at least one electronic threat, to receive observed threat data from a database, to extrapolate future event frequency and to produce a profile of predicted threat activity, wherein the observed threat data includes observed threats and, for each observed threat, one or more targets for the observed threat and a severity score for each target;

determine expected downtime of each system of the plurality of IT systems in dependence upon said predicted threat activity including the severity scores and extrapolated future event frequency;

determine the financial loss for each of the plurality of business processes dependent on the downtimes of the IT systems, and;

add the financial losses for the plurality of business processes so as to obtain a combined financial loss arising from the threat activity.

2. The apparatus according to claim 1, wherein the instructions comprise:

a first module configured to determine the predicted threat activity including, at least one electronic threat, to receive observed threat data from a database, to extrapolate future event frequency and to produce a profile of predicted threat activity, wherein the observed threat data includes observed threats and, for each observed threat, one or more targets for the observed threat and a severity score for each target;

a second module configured to determine the expected downtime of each IT system of the plurality of IT systems in dependence upon said predicted threat activity including the severity scores and extrapolated future event frequency and;

a third module configured to determine the financial loss for each of a plurality of business processes.

3. The apparatus according to claim 2, wherein the third module is configured to add the financial losses for the plurality of business processes.

4. The apparatus according to claim 1, wherein the apparatus is further configured to store at least one of the financial losses and the combined financial loss in a storage device.

5. The apparatus according to claim 1, wherein the apparatus is further configured to output the financial losses and the combined financial loss to other apparatus comprising at least one processor and a memory coupled to the processor, the memory storing instructions being executable by the processor.

6. The apparatus according to claim 1, wherein the apparatus is configured to display at least one of the financial losses and the combined financial loss on a display device.

7. The apparatus according to claim 1, further configured to output the predicted future event activity to a firewall.

8. The apparatus according to claim 1, further configured to output the profile of predicted threat activity to a firewall.

9. The apparatus according to claim 1, wherein the observed list of threats includes, for each threat, information identifying at least one system.

10. The apparatus according to claim 1, wherein the observed list of threats includes, for each threat, information identifying frequency of occurrence of the threat.

11. The apparatus according to claim 10, wherein the frequency of occurrence of the threat includes at least one period of time and corresponding frequency of occurrence for the at least one period of time.

12. The apparatus according to claim 1 wherein the plurality of IT systems include a plurality of software systems.

13. A method of assessing and valuing computer network threats, the threats including at least one electronic threat, the network comprising a plurality of IT systems wherein a plurality of business processes operate on the plurality of IT systems the method comprising, by using at least one computer processor:

predicting threat activity based on past observed activity including, for at least one electronic threat, to receive observed threat data from a database, to extrapolate future event frequency and to produce a profile of predicted threat activity, wherein the observed threat data includes observed threats and, for each observed threat, one or more targets for the observed threat and a severity score for each target;

determining expected downtime of the plurality of IT systems in dependence upon said predicted threat activity including the severity scores and extrapolated future event frequency;

determining the financial loss for the plurality of business processes dependent on the downtimes of the IT systems;

adding the financial losses for the plurality of business processes to obtain a combined financial loss arising from the threat activity.

14. The method according to claim 13, further comprising;

storing at least one of the financial losses and the combined financial loss in a storage device.

15. The method according to claim 13, further comprising;

displaying at least one of the financial losses and the combined financial loss on a display device.

16. A non-transitory computer readable medium storing a computer program which when executed by a computer system, causes the computer system to perform a method of assessing and valuing computer network threats, the threats including at least one electronic threat, the computer network comprising a plurality of IT systems wherein a plurality of business processes operate on the plurality of IT systems, the method comprising:

predicting threat activity based on past observed activity including, at least one electronic threat, to receive observed threat data from a database, to extrapolate future event frequency and to produce a profile of predicted threat activity, wherein the observed threat data includes observed threats and, for each observed threat, one or more targets for the observed threat and a severity score for each target;

determining expected downtime of each of the plurality of IT systems in dependence upon said predicted threat activity including the severity scores and extrapolated future event frequency;

determining the financial loss for the plurality of business processes dependent on the downtimes of the IT systems;

adding the financial losses for the plurality of business processes to obtain a combined financial loss arising from the threat activity.