Amazon Technologies, Inc.

Jared Sylvester

John Schweitzer

Michael Lowney

Wayne Alan Fullen

Patrick Collard

Ravi Karnam

Catherine Watkins

Luke Kenneth Schubert

Evripidis Paraskevas

Stephen Goodman

Elisabeth Margaret Nagy

Jacob Nguyen

William Kupersanin

Sai Srinivas Vemula

Sameer Anil Murudkar

This disclosure describes building a graph that is based on which IP address sources are active in the same time periods. By creating a node for each IP address with some moderate level of suspicious activity and connecting the nodes for any IP addresses that are engaging in that activity at roughly the same time, the graph represents scenarios of possible cooperation between sets of IP addresses. Nodes in this graph and the links between are assigned values based on how much suspicious activity they engage in during each time window. These values decay over time if no new suspicious activity occurs. By analyzing the resulting graph at any particular point in time, how similar two IP addresses have been behaving recently can be measured without having to keep track of their total history of activity over the last time period.

Assessing coordinated malicious behavior towards a service provider network

Described are systems and methods for determining a reputation score and/or a confidence score for a network identifier that represents, respectively, a likelihood that the network identifier presents a threat and/or a likelihood that the network activity associated with the network identifier corresponds to a port scanning, enumeration, or other malicious event. Embodiments of the present disclosure can utilize various network telemetry information, such as authentication activity, outbound traffic activity, web activity, honeypot connection activity, or network classification information to determine the reputation and/or confidence scores in response to a query/request and/or in connection with potentially malicious activity that can represent a likelihood that the detected potentially malicious activity is malicious/legitimate and the potential impact that remediation measures taken against the network identifier may have in the event that the detected network activity was legitimate.

Reputation and confidence scoring for network identifiers based on network telemetry

Growing community of inventors

Ellicott City, MD, United States of America

Jared Sylvester