Threat Intelligence (TI) Sample Clauses

Threat Intelligence (TI). The Threat Intelligence component complements the protection provided by the SecaaS capabilities with advanced analytics mechanisms based on Machine Learning and Deep Learning to detect cybersecurity threats and provide intelligible suggestion to address them. This component is divided into three modules: • Distributed Collectors. • Multi-Modal Machine Learning. • Remediation & Recommendation. The Distributed Collectors are in charge of collecting network data from heterogeneous sources ranging from the physical infrastructure (e.g., routers, switches, and compute clusters) up to the virtualised security services running on top of it. Input data comes in different formats (e.g., network flow data, events, and logs) and needs to be efficiently collected by a set of agents, pre-processed and anonymised in real-time in a format suitable for the ingestion by the Multimodal Machine Learning module. In addition, the data is stored in a distributed file system. The Multi-Modal Machine Learning module is responsible for the implementation of Anomaly Detection methods based on Machine Learning (ML) and Deep Learning (DL) techniques. Different modalities of data coming from different sources (e.g., traffic flows information, network topologies and logs) are combined into a unified representation scheme, i.e., a Knowledge Graph, which allows applying feature extraction methods to automatically select the most important features from the data and adopting advanced ML/DL techniques to detect complex cyber-attacks. Once anomalies are detected, a further step is taken to classify the specific network threat. Finally, by adopting a hybrid approach, these novel analytics-based methods are simultaneously combined with more traditional signature-based intrusion detection systems (deployed as SecaaS). The outcomes of the different methods are aggregated and reported to the Remediation & Recommendation module. The Remediation & Recommendation module is in charge of defining mitigation recommendations based on the results of the previous module. The outcome of this module is the generation of a set of high-level policies to address a specific network security threat which are then translated to a set of medium-level policies (i.e., a set of security requirements) to configure the appropriate xNFs together with their suggested order of deployment. The generated medium-level policies undergo a conflict analysis against inconsistencies or non-enforceable policies and a report is p...