Detection of coordinated cyber-attacks

1. A method of detecting coordinated attacks on at least one of computers or computer networks via a world wide web, the method comprising:

using a web crawler to crawl the world wide web to identify domains and subdomains and their associated internet protocol addresses, and to identify links between domains and subdomains, and storing the results in a database;

detecting a connection or connection attempt to or from a computer or computer network;

identifying a remote internet protocol address associated with the connection or connection attempt as being malicious or suspicious and using the internet protocol address as a lookup in the database to identify the associated domain and subdomain, and any linked domains and subdomains;

identifying those linked domains and subdomains as malicious or suspicious;

detecting further connections or connection attempts to or from the computer or computer network, determining that the associated remote internet protocol addresses are associated with the linked domains and subdomains; and

as a result based on the detecting, generating a topological map identifying a coordinated attack on the at least one of computers or computer networks.

2. The method according to claim 1 , wherein said identifying the remote internet protocol address as being malicious or suspicious comprises comparing the internet protocol address against internet protocol addresses stored in a database containing known internet protocol addresses and respective indications of trustworthiness.

3. The method according to claim 1 further comprising:

continuously performing the using a web crawler to crawl the world wide web in order to construct a massive database of linked domains and subdomains and their internet protocol addresses.

4. The method according to claim 1 , wherein if no linked domains or subdomains are identified, or the information is considered out of date, directing the web crawler to crawl a selected part of the world wide web in dependence upon the domain and subdomain associated with the internet protocol address.

5. The method according claim 1 further comprising:

performing said detecting a connection or connection attempt to or from a computer or computer network at the computer or the computer network, sending an event notification including the remote internet protocol address, to a central server or server cloud, and performing said identifying at the central server.

6. A system for detecting coordinated attacks on at least one of computers or computer networks via a world wide web, the system performing operations comprising:

crawling the world wide web to identify domains and subdomains and their associated internet protocol addresses, to identify links between domains and subdomains, and to store the results in a database;

detecting or receiving a notification that a connection or connection attempt has been made to or from a remote computer or remote computer network, to identify a remote internet protocol address associated with the connection or connection attempt as being malicious or suspicious, to use the internet protocol address as a lookup in the database to identify the associated domain and subdomain, and any linked domains and subdomains, and to identify those linked domains and subdomains as malicious or suspicious;

detecting further connections or connection attempts to or from the computer or computer network, determining that the associated remote internet protocol addresses are associated with the linked domains and subdomains; and

as a result based on the detecting, generating a topological map identifying a coordinated attack on the at least one of computers or computer networks.

7. A computer program product comprising a non-transitory computer storage medium having computer code stored thereon which, the computer code executed by at least one computer of a computer system, causes the computer system to:

use a web crawler to crawl the world wide web to identify domains and subdomains and their associated internet protocol addresses, and to identify links between domains and subdomains, and storing the results in a database;

detect a connection or connection attempt to or from a computer or computer network;

identify a remote internet protocol address associated with the connection or connection attempt as being malicious or suspicious and using the internet protocol address as a lookup in the database to identify the associated domain and subdomain, and any linked domains and subdomains;

identify those linked domains and subdomains as malicious or suspicious;

detect further connections or connection attempts to or from the computer or computer network, determine that the associated remote internet protocol addresses are associated with the linked domains and subdomains; and

based on the detecting, generate a topological map identifying a coordinated attack on the computer system.

8. The computer program product according to claim 7 , wherein said identifying the remote internet protocol address as being malicious or suspicious comprises comparing the internet protocol address against internet protocol addresses stored in a database containing known internet protocol addresses and respective indications of trustworthiness.

9. The computer program product according to claim 7 further comprising:

continuously performing using the web crawler to crawl the world wide web in order to construct a massive database of linked domains and subdomains and their internet protocol addresses.

10. The computer program product according to claim 7 , wherein, if no linked domains or subdomains are identified, or the information is considered out of date, directing the web crawler to crawl a selected part of the world wide web in dependence upon the domain and subdomain associated with the internet protocol address.

11. The computer program product according to claim 7 further comprising:

performing said detecting a connection or connection attempt to or from a computer or computer network at the computer or the computer network, sending an event notification including the remote internet protocol address, to a central server or server cloud, and performing said identifying at the central server.