Threatconnect, Inc.

Bhaskar Karambelkar

Daniel Cole

Danny Tineo

Andrew Pendergast

Jason Spies

Andrew Gidwani

Christopher Johnson

Wade Baker

Richard M Barger

Techniques are disclosed which can provide an orchestrated response to a cybersecurity threat. This orchestrated response may be based upon, at least in part, a reputation score. Threat model(s) may be received that identify cybersecurity threat(s). An indication of observations, false positives, and/or page views for the threat may be obtained. Data feeds may be received including known good data feeds, known bad data feeds, and enrichment data feeds. The data feeds may provide information about one or more indicators of compromise (IOC). For each IOC, a weighted criticality score may be determined. The weighted criticality score may be mapped to a corresponding point value. An aggregated score may be determined based upon at least the corresponding point value. A reputation score may be computed, and in some configurations, provided to a user.

Enrichment and analysis of cybersecurity threat intelligence and orchestrating application of threat intelligence to selected network security events

In some embodiments, an apparatus includes a memory and a processor operatively coupled to the memory. The processor is configured to receive a set of domain name resolutions associated with a domain. Each domain name resolution from the set of domain name resolutions includes a mapping between a domain name and an Internet Protocol (IP) address. The processor is then configured to determine, based on the set of domain name resolutions, a set of resolution metrics associated with a first geolocation and a set of resolution metrics associated with a second geolocation. The processor is also configured to compare and identify a role of an adversary infrastructure at the first geolocation and a role of an adversary infrastructure at the second geolocation, and subsequently send a signal such that a remedy response associated with at least one of the set of IP addresses or the domain name is initiated.

Methods and apparatus for identifying and characterizing computer network infrastructure involved in malicious activity

Growing community of inventors

Ashburn, VA, United States of America

Bhaskar Karambelkar