Abstract: A method for providing an automatically enhanced model of one or more networks, the method may include (a) determining missing next hop points; (b) finding multiple linkable pairs of relevant network elements interfaces, wherein a relevant network element interface is associated with one of the missing next hop points; and virtually linking relevant first network element interfaces of the multiple linkable pairs and the relevant second network element interfaces of the multiple linkable pairs to provide the automatic enhanced model of the one or more network. The virtually linking may include virtually adding one or more artificial network elements between the relevant first network element interfaces of the multiple linkable pairs and the relevant second network elements interfaces of the multiple linkable pairs.

Abstract: A method for providing an automatically enhanced model of one or more networks, the method may include (a) determining missing next hop points; (b) finding multiple linkable pairs of relevant network elements interfaces, wherein a relevant network element interface is associated with one of the missing next hop points; and virtually linking relevant first network element interfaces of the multiple linkable pairs and the relevant second network element interfaces of the multiple linkable pairs to provide the automatic enhanced model of the one or more network.

Abstract: A method for evaluating a scope of cyber-attack incidents, the method may include detecting original compromised assets and malicious external machines that are related to each of the cyber-attack incidents; classifying potentially compromised assets to different classes based on (a) similarities between the potentially compromised assets and the original compromised assets, (b) a level of accessibility from the original compromised assets and malicious external machines to the potentially compromised assets, and (c) volumes of traffic between the potentially compromised assets and each one of the malicious external machines and the original compromised assets; wherein the different classes comprise compromised and non-compromised; and generating an alert that is indicative of the compromised assets and of potentially compromised assets that were classified as compromised.

Abstract: A method for automatically translating a banner information, the method may include receiving by a computer the banner information, wherein the banner information is included in at least one banner and describes an identity of a software product; and translating by the computer the banner information into a unique software product identifier using a content of knowledgebase that comprises an attributes schema and translation rules; wherein each software product is associated with a single unique software product identifier; wherein the unique software product identifier comprises a structured set of attributes; wherein at least one translation rule is a pattern based translation rule; wherein the attributes schema specifies a set of allowable attributes and of allowable values of the attributes.