F-Secure Corporation

Marko Finnig

Jarno Niemelä

Janne Pirttilahti

Joakim Sandstrom

A method of detecting coordinated attacks on computer and computer networks via the internet. The method includes using a web crawler to crawl the world wide web to identify domains and subdomains and their associated IP addresses, and to identify links between domains and subdomains, and storing the results in a database. When an IP address is identified as malicious or suspicious, the IP address is used as a lookup in the database to identify the associated domain and subdomain, and linked domains and subdomains. Those linked domains and subdomains are then identified as malicious or suspicious.

Detection of coordinated cyber-attacks

There are provided measures for enabling advanced local-network threat response. Such measures could exemplarily comprise receiving, at a local-network honeypot entity, a username/password related authentication data in relation to a login attempt to the honeypot entity, triggering a threat response operation at a local-network backend entity upon detection of the username/password related authentication data, the threat response operation comprising testing validity of the username/password related authentication data in one or more local accounts of the local-network, and in case the username/password related authentication data is detected to be valid for any account in the local-network, determining that said account is compromised and locking the compromised account.

Growing community of inventors

Helsinki, Finland

Marko Finnig