Methods and apparatus for analyzing asynchronous cyber-threat event data using discrete time intervals

Abstract

Apparatus and methods described herein relate to a global workspace manager that can dynamically update historical cyber-threat data for a network. The global workspace manager can receive cyber-threat event data including a time of a cyber-threat event. The global workspace manager can identify a workspace node in a workspace graph associated with the cyber-threat event data, and can identify a threat score interval including a set of times that includes the time of the cyber-threat event. The global workspace manager can retrieve, from the workspace node, a threat score calculation function associated with the threat score interval, and can calculate a threat score for the workspace node during the threat score interval using the threat score calculation function and the cyber-threat event data. The global workspace manager can calculate a set of threat scores based on the threat score for the workspace nodes, such that each threat score in the set of threat scores is associated with the remaining workspace nodes in the workspace graph.