Abstract: Computer system, method and program product for identifying a malicious intrusion. A first number of different destination IP addresses, a second number of different destination ports and a third number of different signatures of messages, are identified from a source IP address during a predetermined period. A determination is made that in one or more other such predetermined periods the source IP address sent messages having the first number of different destination IP addresses, the second number of different destination ports and the third number of different signatures. Based on the determination that in the one or more other such predetermined periods the source IP address sent messages having the first number of different destination IP addresses, the second number of different destination ports and the third number of different signatures, a determination is made that the messages are characteristic of a malicious intrusion.

Abstract: A method, system and computer program product is disclosed that provides timely, accurate and summarized information about possible threats to information technology environments. It is a tool that looks at multiple aspects of an IT threat, including both specific (traditional) IT threats and general (non-traditional) IT threats, and rates each threat's overall potential to do harm. A matrix is created that identifies a “threat score” to allow prioritization and reaction to the threats. The matrix takes both traditional IT threats and non-traditional IT threats and normalizes them on the same scale, giving users of the matrix the ability to understand the risks of both.