Amazon Technologies, Inc.

Ironnet Cybersecurity, Inc.

Michael Lowney

Patrick Collard

John Schweitzer

Wayne Alan Fullen

Phillip Baker Schafer

Stephen Kinser

Jared Sylvester

Alexander Michael Conn

Catherine Watkins

Sameer Anil Murudkar

Luke Kenneth Schubert

Sai Srinivas Vemula

William Kupersanin

Ravi Karnam

Evripidis Paraskevas

Elisabeth Margaret Nagy

Stephen Goodman

Jacob Nguyen

This disclosure describes building a graph that is based on which IP address sources are active in the same time periods. By creating a node for each IP address with some moderate level of suspicious activity and connecting the nodes for any IP addresses that are engaging in that activity at roughly the same time, the graph represents scenarios of possible cooperation between sets of IP addresses. Nodes in this graph and the links between are assigned values based on how much suspicious activity they engage in during each time window. These values decay over time if no new suspicious activity occurs. By analyzing the resulting graph at any particular point in time, how similar two IP addresses have been behaving recently can be measured without having to keep track of their total history of activity over the last time period.

Assessing coordinated malicious behavior towards a service provider network

Described are systems and methods for determining a reputation score and/or a confidence score for a network identifier that represents, respectively, a likelihood that the network identifier presents a threat and/or a likelihood that the network activity associated with the network identifier corresponds to a port scanning, enumeration, or other malicious event. Embodiments of the present disclosure can utilize various network telemetry information, such as authentication activity, outbound traffic activity, web activity, honeypot connection activity, or network classification information to determine the reputation and/or confidence scores in response to a query/request and/or in connection with potentially malicious activity that can represent a likelihood that the detected potentially malicious activity is malicious/legitimate and the potential impact that remediation measures taken against the network identifier may have in the event that the detected network activity was legitimate.

Reputation and confidence scoring for network identifiers based on network telemetry

Methods and systems for the detection, identification, analysis of cybersecurity events in order to support prevention of the persistence of threats, malware or other harmful events are provided. The methods and systems of the present invention enable a user to find similar anomalous network traffic within a single network or across multiple networks. The methods and systems identify and correlate activity in order to analyze potential threats within a network by providing broader contextual information about how those threats relate to other activity within the network or across a sector or country.

Systems and methods for analyzing cybersecurity events

Growing community of inventors

Arlington, VA, United States of America

Michael Lowney