Apparatus, system and method for identifying and mitigating malicious network threats

1. A system for identifying malicious threats on a network comprising:

a computing device including a processor coupled to a system memory, the system memory storing instructions for execution on the processor, the instructions configured to cause the processor to:

retrieve a network data associated with at least one of an IP address or a domain, wherein the network data comprises information indicating an amount of data transceived by at least one element of the network;

analyze the network data and identify a malicious network threat, including identifying at least one bot command computer by tracing at least some of the data transceived by the at least one element of the network to a bot, and then tracing communications between the bot and the bot command computer;

push a notification including a mitigating action for the malicious network threat to a third party device; and

cause the mitigating action to be performed to neutralize the malicious network threat.

2. The system of claim 1 , wherein the network data is retrieved from an edge router, wherein the network data comprises a snapshot of traffic being routed through the edge router.

3. The system of claim 1 , further comprising a traffic measurement aggregator module logically connected to an edge router interface.

4. The system of claim 1 , wherein the network data comprises data from a border gateway protocol table associated with a primary computer network's connectivity relationships with at least one secondary network.

5. The system of claim 1 , wherein the instructions are further configured to cause the processor to:

normalize the network data to a standard format;

decorate the network data with at least one tag that identifies the network activity data;

store the network data in a database;

weight the network data according to a threat associated with the data; and

generate a risk score for the weighted data.

6. The system of claim 5 , wherein the instructions are further configured to cause the processor to generate the risk score by:

compare a new activity at the IP address or the domain to a past activity at the IP address or the domain;

determine whether the new activity fits a profile for a malicious IP address or domain;

correlate the risk score with a previous malicious threat; and

adjust the risk score according to the correlation.

7. The system of claim 6 , wherein the instructions are further configured to cause the processor to predict a network based attack according at least the risk score.

8. The system of claim 1 , wherein the mitigating action comprises at least one of a null routing the malicious network threat, adjusting an access control list (ACL) to block the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from a network.

9. A method for identifying malicious threats on a network comprising:

retrieving a network data associated with at least one of an IP address or a domain, wherein the network data comprises information indicating an amount of data transceived by at least one element of the network;

analyzing the network data to identify a malicious network threat, including identifying at least one bot command computer by tracing at least some of the data transceived by the at least one element of the network to a bot, and then tracing communications between the bot and the bot command computer;

pushing a notification including a mitigating action for the malicious network threat to a third party device; and

causing the mitigating action to be performed to neutralize the malicious network threat.

10. The method of claim 9 , wherein the network data is retrieved from an edge router.

11. The method of claim 10 , further comprising measuring a rate of data transceived by the edge router at a measurement aggregator module logically connected to an edge router interface.

12. The method of claim 11 , wherein the network data comprises data from a border gateway protocol table associated with a primary computer network's connectivity relationships with at least one secondary network.

13. The method of claim 9 , further comprising:

normalizing the network data to a standard format;

decorating the network data with at least one tag that identifies the network activity data;

storing the network data in a database;

weighing the network data according to a threat associated with the data; and

generating a risk score for the weighted data.

14. The method of claim 13 , wherein the risk score is generated by:

comparing a new activity at the IP address or the domain to a past activity at the IP address or the domain;

determining whether the new activity fits a profile for a malicious IP address or domain;

correlating the risk score with a previous malicious threat; and

adjust the risk score according to the correlation.

15. The method of claim 14 , further comprising predicting a network based attack according at least the risk score.

16. The method of claim 9 , wherein the mitigating action comprises at least one of a null routing the malicious network threat, adjusting an access control list (ACL) to block the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from a network.