Abstract: Disclosed, in one general aspect, is a network security system that includes pipeline storage operative to receive a series of malware samples. A sandboxed operating environment is responsive to the pipeline storage and operative to automatically retrieve successive malware samples from the pipeline storage, to run each of the malware samples in the sandboxed operating environment after it is retrieved, and to analyze at least some communication from each of the malware samples as they are run. A verdict output is responsive to the sandboxed operating environment to provide a verdict for malicious internet infrastructure associated with at least some of the malware samples run in the sandboxed operating environment.

Abstract: Disclosed, in one general aspect, is a network security system that includes a network traffic analysis tool operative to extract information about traffic with suspected attack support infrastructure addresses. An automated traffic pattern recognition tool is responsive to information extracted by the network traffic analysis tool and to enrichment data, and is operative to detect patterns in the extracted traffic information. An identification tool is responsive to the pattern recognition tool to identify victims associated with the suspected attack support infrastructure addresses based on patterns detected in the extracted traffic information. And the system includes storage that is responsive to the identification tool for storing the recorded suspected attack support infrastructure addresses and identified victims on an ongoing basis.