Abstract: A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

Abstract: A computer-implemented method for estimating ages of network devices may include (1) identifying at least one networked device that may be attached to a network, (2) identifying a media access control address of the networked device, the media access control address comprising an organizational unique identifier, (3) querying an organizational-unique-identifier database with the organizational unique identifier and receiving, in response, device-age information relating to an estimated age of the networked device and (4) determining the estimated age of the networked device based at least in part on the device-age information. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

Abstract: A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

Abstract: A computer-implemented method for discovering network topologies. The method may include (1) receiving, on a host system within a network, a switch-protocol message that includes a switch identifier, a port identifier, and/or a root path cost, (2) identifying a set of switches within the network based on the switch-protocol message, (3) determining how the set of switches are connected based on the switch-protocol message, and (4) mapping a topology of the network based on determining how the set of switches are connected. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.

Abstract: A computer-implemented method for mapping network topologies may include (1) identifying a network including a plurality of network switches and a plurality of host systems, (2) identifying a host system within the plurality of host systems connected to the network via a network switch within the plurality of network switches, (3) refreshing an address of the host system within the network switch, (4) allowing the address of the host system to expire from each network switch within the plurality of network switches except the network switch, (5) transmitting a probing frame from a probing host system within the plurality of host systems to the address of the host system, (6) identifying a subset of host systems within the plurality of host systems that received the probing frame, and then (7) mapping a topology of the network based on the identified subset. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Detection of network devices (e.g., stealth devices) and mapping network topology are performed via network introspection by collaborating endpoints/nodes. The method includes receiving (e.g., by a node on a network) an assignment to be a supernode that will manage multiple agents of a subnetwork within an overall network. This assigned supernode instructs two or more of the agents to perform a set of network traffic fingerprinting tests of the subnetwork by passing information across the subnetwork to each other. The supernode receives results of the tests from the clients and detects one or more intermediate devices located between the clients based on an effect of the intermediate devices on the information passed between the clients. The supernode can further map the topology of the subnetwork (including the detected devices) which can be used in mapping the overall network topology.

Abstract: A method of monitoring events in a network associated with a node. An agent collects event information associated with the monitored activities, based on a set of collection rules. A determination is made whether a portion of the collected event information complies or potentially complies with one of a set of patterns. An agent selects event information from the collection based on the determination, and makes the selected event information available to a manager associated with the node and other nodes in the network. The agent manager receives event information from a plurality of agents. A triggering event is identified, as a function of the set of patterns, based on the event information. The agent manager sends at least one request to a selected set of the agents for additional event information when a triggering event is identified.

Abstract: Computer-implemented methods, apparati, and computer-readable media for thwarting computer attacks. A method embodiment of the present invention comprises the steps of examining (52) a digital certificate (20) presented by a server computer (2); compiling (53) a set of suspicion indications (31) gleaned from said examining step (52); and feeding (54) said suspicion indications (31) to a consequence engine (30).

Abstract: An electronic message manager (100) examines (210) incoming electronic messages and determines (220) whether an incoming electronic message comprises at least one suspect link associated with a remote system. In response to the determination (220) that the incoming message comprises at least one suspect link, the electronic message manager (100) replaces (230) each suspect link with a redirection link. In response to a user attempting (240) to connect to the remote system by clicking on the redirection link, the electronic message manager directs the user to a remote analysis site for deciding (260) whether that incoming message comprises a phishing message.