Abstract: A particular failed connection attempt initiated by a particular source asset in a network is identified and subsequent failed connection attempts initiated by the particular source asset in the network during a time period are tracked. A low frequency sequence of failed connection attempts involving the particular source asset is detected during the time period and the source asset is designated as a potential security risk based on the detected low frequency sequence of failed connection attempts.

Abstract: A method is provided in one example embodiment that includes identifying a file format identifier associated with a beginning of a file, parsing the file based on the file format identifier until an end of the file is identified, and calculating a hash from the beginning of the file to the end of the file. The method may also include sending the hash to a reputation system and taking a policy action based on the hash's reputation received from the reputation system.

Abstract: Source assets are monitored for activities, each activity associated with a corresponding activity weight indicating probability of the activity resulting from a security compromise. A source asset is determined to perform a particular activity indicative of a potential security compromise, such as a download of an executable of malicious reputation. A source asset tracking instance is instantiated to include data identifying the particular activity. The tracking instance is to be updated based on identification of subsequently monitored activities. A reputation value is determined for the activity weight of the particular activity based at least in part on the malicious reputation of the executable. An asset reputation is determined for the source asset from the corresponding activity weights of monitored activities involving the source asset and a security risk is determined when the asset reputation exceeds a threshold.

Abstract: A system, method, and computer program product are provided for flagging a network flow as at least potentially unwanted. In use, a network flow is identified as utilizing an unknown protocol. Further, the network flow is flagged as at least potentially unwanted.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for adjusting the sensitivity of a behavior detection process on a per-device basis based on a local reputation for each device.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for stealth attack monitoring. In one aspect, a method includes monitoring a network for failed connection attempts in the network, wherein each failed internal connection attempt is initiated by a source asset and is an attempt to connect to a destination asset; and only in response to detecting a failed connection attempt initiated by a source asset, instantiating a source asset tracking instance in a computer memory, and for each source asset tracking instance in the computer memory: monitoring the corresponding source asset for a threshold number of failed connection attempts to destination assets during a time period; and in response to detecting the threshold number of failed connection attempts from the source asset during the time period for the source asset tracking instance, designating the source asset as a security risk.

Abstract: A method is provided in one example embodiment that includes identifying a file format identifier associated with a beginning of a file, parsing the file based on the file format identifier until an end of the file is identified, and calculating a hash from the beginning of the file to the end of the file. The method may also include sending the hash to a reputation system and taking a policy action based on the hash's reputation received from the reputation system.

Abstract: A method is provided in one example embodiment that includes detecting repetitive connections from a source node to a destination node, calculating a score for the source node based on the connections, and taking a policy action if the score exceeds a threshold score. In more particular embodiments, the repetitive connections use a hypertext transfer protocol and may include connections to a small number of unique domains, connections to small number of unique resources associated with the destination node, and/or a large number of connections to a resource in a domain. Moreover, heuristics may be used to score the source node and identify behavior indicative of a threat, such as a bot or other malware.

Abstract: A method is provided in one example embodiment and includes exchanging a session descriptor associated with a network connection and an application on a host, correlating the session descriptor with a network policy, and applying the network policy to the network connection. In alternative embodiments, the session descriptor may be exchanged through an out-of-band communication channel or an in-band communication channel.

Abstract: A system, method, and computer program product are provided for flagging a network flow as at least potentially unwanted. In use, a network flow is identified as utilizing an unknown protocol. Further, the network flow is flagged as at least potentially unwanted.