Methods, apparatus and computer software products implement embodiments of the present invention that include defining, for a given software category, respective, disjoint sets of communication ports that are used by each of a plurality of software systems in the given software category, including at least first and second disjoint sets. A set of port scans are identified in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans including an access, in the data traffic, of a plurality of the communication ports on a given destination node by a given source node during a predefined time period. Upon detecting a port scan by one of the nodes including accesses of at least one of the communication ports in the first set and at least one of the communication ports in the second set, a preventive action is initiated.

The present disclosure is directed towards systems and methods for evaluating or mitigating a network attack. A device determines one or more client internet protocol addresses associated with the attack on the service. The device assigns a severity score to the attack based on a type of the attack. The device identifies a probability of a user account accessing the service during an attack window based on the type of attack. The device generates an impact score for the user account based on the severity score and the probability of the user account accessing the service during the attack window. The device selects a mitigation policy for the user account based on the impact score.

A threat actor identification system that obtains domain data for a set of domains, generates domain clusters, determines whether the domain clusters are associated with threat actors, and presents domain data for the clusters that are associated with threat actors to brand owners that are associated with the threat actors. The clusters may be generated based on similarities in web page content, domain registration information, and/or domain infrastructure information. For each cluster, a clustering engine determines whether the cluster is associated with a threat actor, and for clusters that are associated with threat actors, corresponding domain information is stored for presentation to brand owners to whom the threat actor poses a threat.

The present disclosure provides systems and methods of selecting candidates for comparison of fingerprints of devices. An exemplary method comprises calculating a digital fingerprint of a device, determining a group of digital fingerprints where the digital fingerprint occurs, calculating vectors of changed features of each digital fingerprint, calculating a probability that the digital fingerprint and each digital fingerprint within the group belong to the same chain, identifying a set of candidates from the group whose probability of belonging to the same chain of fingerprints crosses a value, comparing the calculated digital fingerprint of the device with the fingerprints in the set of candidates, determine that the device correspond to a device in the set of candidates when the comparison results in a match higher than a specified threshold and permitting the user actions, otherwise tracking the user actions with the online service as fraudulent activity.

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for incident response are disclosed. In one aspect, a system includes a cognitive engine that is configured to receive data identifying actions performed in response to a computer security threat. Based on the data identifying the actions performed in response to the computer security threat, the system generates one or more workflows and a particular workflow that are associated with the computer security threat and that each identify one or more actions to remediate the computer security threat. The system also includes a scoring system and event triage engine that is configured to analyze the actions of the one or more workflows and of the particular workflow, and based on analyzing the actions of the one or more workflows and of the particular workflow, select a primary workflow as a workflow to respond to the computer security threat. The system also includes an automated incident investigation engine that is configured to receive an alert that identifies the computer security threat, and process the computer security threat according to the primary workflow that is associated with the computer security threat and that identifies one or more actions to remediate the computer security threat.

A method and associated systems for isolating a source of an attack that originates from a shared computing environment. A computer-security system tags outgoing packets originating from within the shared computing environment in a tamper-proof manner in order to identify which tenant of the shared environment is the true source of each packet. If one of those tenants transmits malicious packets to an external recipient, either because the tenant has malicious intent or becomes infected with malware, the transmitted malicious packets' tags allow the recipient to determine which tenant is the source of the unwanted transmissions. The recipient may then block further communications from the problematic tenant without blocking communications from other tenants of the shared environment.

A system and method for botmaster discovery are disclosed. The system and method may be used in a network that has a plurality of known malicious domains, a plurality of servers each having a known malicious internet protocol (IP) address in which each server is associated with one or more of the plurality of domains, a plurality of hosts associated with one or more of the plurality of servers wherein the host is one of a bot which is compromised host and involved as a part of resource for cyber-crime purpose and a botmaster which involves bots for cyber-crime purpose. The system and method generate a plurality of clusters of known malicious entities, the known malicious entities being one or more known malicious IP addresses, one or more known malicious domains and a known malicious domain and a known malicious IP address, perform flow matching of each IP address in each cluster of known malicious entities between a plurality of source IP addresses and a plurality of destination IP addresses to identify a plurality of host flows wherein each host flow has a source IP address or a destination IP address matched a particular IP address in a cluster of known malicious entities and detect a bot master of each cluster of known malicious entities from the plurality of host flows corresponding to each cluster of known malicious entities by analyzing difference of flow features between the bot and the botmaster.

An attack situation visualization device includes: a memory that stores instructions; and at least one processer configured to process the instructions to: analyze a log in which information about a cyberattack is recorded and specify at least either of a source of a communication related to the cyberattack and a destination of a communication related to the cyberattack; and generate display information allowing display of an image in which an image representing a map, a source image representing the source, and a destination image representing the destination are arranged on the map, wherein, the at least one processer configured to process the instructions to generate the display information including an attack situation image visualizing at least either of a traffic volume and a communication frequency of a communication related to the cyberattack between the source and the destination.

A novel enterprise security solution allows for precise interception and surgical response to attack progression, in real time, as it occurs across a distributed infrastructure. The solution includes a data monitoring and management framework that continually models system level host and network activities as mutually exclusive infrastructure wide execution sequences and bucketizes them into unique execution trails. A multimodal intelligent security middleware detects indicators of compromise in real-time on top of subsets of each unique execution trail using rule based behavioral analytics, machine learning based anomaly detection, and other sources. Each detection result dynamically contributes to aggregated risk scores at execution trail level granularities. These scores can be used to prioritize and identify highest risk attack trails to end users, along with steps that such end users can perform to mitigate further damage and progression of an attack.

A network surveillance method to detect attackers, including planting one or more honeytokens in one or more resources in a network of computers in which users access the resources in the network based on credentials, wherein a honeytoken is an object in memory or storage of a first resource that may be used by an attacker to access a second resource using decoy credentials, including planting a first honeytoken in a first resource, R.sub.1, used to access a second resource, R.sub.2, using first decoy credentials, and planting a second honeytoken in R.sub.1, used to access a third resource, R.sub.3, using second decoy credentials, and alerting that an attacker is intruding the network only in response to both (i) an attempt to access R.sub.2 using the first decoy credentials, and (ii) a subsequent attempt to access R.sub.3 using the second decoy credentials.