Apparatus, system and method for identifying and mitigating malicious network threats
Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat.
1. A system for identifying malicious threats on a network comprising:
a computing device including a processor coupled to a system memory, the system memory storing instructions for execution on the processor, the instructions configured to cause the processor to:
retrieve network data associated with at least one of an IP address or a domain, wherein the network data comprises information indicating an amount of data transceived by multiple elements of the network;
analyze the network data and identify a malicious network threat by performing the steps of:
normalizing the network data to a standard format;
supplementing the network data with at least one tag that identifies the network data;
determining whether the network data indicates that a series of packets of a same size have been transmitted from a common location to the multiple elements of the network;
determining types of ports from which the packets emanated;
storing the network data in a database;
weighting the network data according to a threat associated with the network data, wherein the network data is related to the packets and wherein weighting the network data is based on the types of ports from which the packets emanated; and
generating a risk score for the weighted data; and
based on the risk score for the weighted data, performing a mitigating action to neutralize the malicious network threat, wherein the mitigating action comprises at least one of a null routing the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from the network.
2. The system as recited in claim 1 , wherein the instructions are further configured to cause the processor to:
compare a new activity at the IP address or the domain to a past activity at the IP address or the domain;
determine whether the new activity fits a profile for a malicious IP address or domain;
correlate the risk score with a previous malicious threat; and
adjust the risk score according to the correlation.
3. The system as recited in claim 2 , wherein the instructions are further configured to cause the processor to:
predict a network-based attack according to at least the risk score for the weighted data.
4. A method for identifying malicious threats on a network comprising:
retrieving a network data associated with at least one of an IP address or a domain, wherein the network data comprises information indicating an amount of data transceived by multiple elements of the network;
analyzing the network data and identify a malicious network threat by performing the steps of:
normalizing the network data to a standard format;
supplementing the network data with at least one tag that identifies the network data;
determining whether the network data indicates that a series of packets of a same size have been transmitted from a common location to the multiple elements of the network;
determining types of ports from which the packets emanated;
storing the network data in a database;
weighting the network data according to a threat associated with the network data, wherein the network data is related to the packets and wherein weighting the network data is based on the types of ports from which the packets emanated; and
generating a risk score for the weighted data; and
based on the risk score for the weighted data, performing a mitigating action to neutralize the malicious network threat, wherein the mitigating action comprises at least one of a null routing the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from the network.
5. The method as recited in claim 4 , wherein the risk score is generated by:
comparing a new activity at the IP address or the domain to a past activity at the IP address or the domain;
determining whether the new activity fits a profile for a malicious IP address or domain;
correlating the risk score with a previous malicious threat; and
adjust the risk score according to the correlation.
6. The method as recited in claim 5 , further comprising predicting a network-based attack according to at least the risk score for the weighted data.
7. A method for identifying malicious threats on a network comprising:
retrieving a network data associated with at least one IP address, wherein the network data comprises information indicating an amount of data transceived by multiple elements of the network;
analyzing the network data and identify a malicious network threat by performing the steps of:
normalizing the network data to a standard format;
supplementing the network data with at least one tag that identifies the network data;
determining whether the network data indicates that a series of packets of a same size have been transmitted from a common location to the multiple elements of the network;
determining types of ports from which the packets emanated;
storing the network data in a database;
weighting the network data according to a threat associated with the network data, wherein the network data is related to the packets, wherein weighting the network data is based on the types of ports from which the packets emanated, and wherein a lower weighting is given to network data related to packets emanating from a type of port that commonly transmits packets; and
generating a risk score for the weighted data, wherein in the risk score is determined based on the weighted data and an evaluation of security of a computer operating at the IP address; and
based on the risk score for the weighted data, performing a mitigating action to neutralize the malicious network threat, wherein the mitigating action comprises at least one of a null routing the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from the network.
8. The method as recited in claim 7 , wherein the risk score is generated by:
comparing a new activity at the IP address to a past activity at the IP address or the domain;
determining whether the new activity fits a profile for a malicious IP address;
correlating the risk score with a previous malicious threat; and
adjust the risk score according to the correlation.
9. The method as recited in claim 8 , further comprising predicting a network-based attack according to at least the risk score for the weighted data.