Cujo LLC

Santeri Kangas

Leonardas Marozas

Filip Savin

Syed Alam

Chris Griffiths

Kimmo Kasslin

Leonid Kuperman

Matteo Cafasso

James Mathews

Sean Tiernan

Toni Ala-Piirto

Ivar Beljaars

One or more features of a connected device are determined. A set of websites potentially accessed by the connected device are defined based on the one or more features. Reputation data for the set of websites is determined. The reputation data for the set of websites is stored into a cache. Network traffic between the connected device and an accessed website is intercepted. Reputation data for the accessed website is retrieved from the cache based on the network traffic. A cybersecurity operation related to the connected device is performed based on the reputation data for the accessed website.

Website reputation cache based on connected device features

There is provided a method comprising receiving a domain name system (DNS) query from a client computing device, decrypting the DNS query by a DNS resolver device, and requesting reputation information related to the FQDN from an agent device of the router apparatus. If a matching FQDN is not found in a local database, the DNS query is allowed to proceed from the DNS resolver device to a cloud DNS resolver, the IP and MAC address of the client computing device are logged and mapped to the local database, the reputation information related to the FQDN is requested from a cloud FQDN server, and if the reputation information indicates that the FQDN should be blocked, the local database is updated with the reputation information and further queries to the FQDN are blocked.

Local network device connection control

A first data communication of a first connected device related to a first target website is intercepted. The first data communication identifies the first target website by a first fully qualified domain name (FQDN), and the first FQDN is mapped to a first Internet protocol (IP) address. A pair of the first FQDN and the first IP address is determined. A second data communication of a second connected device related to a second target website is intercepted. The second data communication comprises a second encrypted FQDN and a second IP address of the second target website. The second IP address is determined to be equal to the first IP address. A cybersecurity reputation of the second target website is retrieved based on the first FQDN. In response to determining that the reputation matches a predetermined alarm condition, a cybersecurity operation is enforced for the second data communication.

Discovery of FQDN for target website

A network apparatus maintains a data repository comprising network traffic data related to a plurality of user devices, the network traffic data being collected from a plurality of Network Service Providers (NSPs). A subset of the plurality of user devices are detected to be communicating with one or more same endpoint devices based on analysing the network traffic data. A number of historical connections between each user device of the subset of the plurality of user devices and the one or more endpoint devices is determined based on analysing historical connection data maintained in the data repository, and in response to detecting that the number of historical connections between the subset of the plurality of user devices and the one or more endpoint devices exceeds a predetermined threshold, the one or more endpoint devices are identified as a suspected botnet.

Detecting botnets

Fully qualified domain name determination is disclosed. A queue of fully qualified domain names (FQDN) is created using a predetermined amount of network domains. Each FQDN is crawled from a plurality of collection agents of a computer network. For each FQDN, data comprising an Internet Protocol (IP) address of the FQDN, IP addresses for resources loaded for the FQDN and load times of the resources loaded for the FQDN are extracted. A correlation model is generated based on the data. An FQDN being accessed by one or more computer devices of the computer network is determined by using the correlation model.

Fully qualified domain name (FQDN) determination

An application detection method includes receiving, from one or more user devices on a plurality of local networks, first network traffic metadata being related to a client application running on the one or more user devices, receiving, from a plurality of network traffic hubs of the plurality of local networks, second network traffic metadata corresponding to the first network traffic metadata but excluding user device specific data, generating a plurality of combined network traffic metadata datasets for each received first network traffic metadata and the corresponding second network traffic metadata by matching metadata attributes of the first and second network traffic metadata, generating an application detection model by using the plurality of combined network traffic metadata datasets, and using the application detection model for detecting further client applications running on one or more user devices on one or more local networks.

Growing community of inventors

Kirkkonummi, Finland

Santeri Kangas