ThreatRank: aggregating and prioritizing network threats

The need to defend computer networks becomes increasingly vital as the volume of data generated by both man and machine continues to explode. However, the capability of rapidly analyzing large numbers of heterogeneous threat sensors (feeds) for various security outposts has become its own challenge. Ideally, one would like to aggregate these threat feeds and prioritize incidents at a global view, based on the entire context that is observable. However, this is not trivial; feeds vary in terms of how they report similar information, and there is no central aggregation point to cluster similar threats. For this SBIR, we propose ThreatRank, a system for rapidly and automatically integrating, aggregating, and ranking data from these feeds, to organize and simplify the global view of current threats, so that situational awareness can be maximized. Our approach builds on our significant experience with AI and statistically-based approaches to intelligent data integration and prediction, offering a way to handle the problem in a scalable, maintainable manner.