Abstract: The invention broadly comprises a method and service of visualization of Internet nodes involved in distributed electronic crime in order to see patterns of actionable intelligence, such as multiple phishing nodes hosted at the same hosting center, or domain names registered in one country that are actually in another country or nodes related by one or more aspects, such as specific criminal attack campaign, target or technical weakness exploited to ease commandeering of the node. The invention involves collecting topological and latency data including changes over time and using the data to determine probable topological and geographical locations of single or multiple nodes, as well as inferential geolocation.

Abstract: The invention broadly comprises a method for determining financial loss related to performance of an internetwork. The method correlates input information regarding performance of an internetwork to operations of a financial entity underwriting insurance premiums and bonds and translates the correlated input information into at least one operational risk for the entity. In some aspects, the internetwork is the Internet. The method gathers secondary external information other than directly from the internetwork, correlates the input and secondary external information, and translates the correlated input and secondary external information into at least one operational risk for the entity. For at least one subset and one peril, the method determines a spread in time and space of effects of the at least one anomaly and peril on the internetwork and on the at least one subset.

Abstract: The invention broadly comprises a computer-based method for presenting information regarding network performance and topology. The steps of the method include: displaying a first plurality of nodes in the network; displaying edges associated with the first plurality of nodes; and, displaying latency associated with the edges. The preceding steps, and those that follow, are performed by at least one general-purpose computer specially programmed to perform these steps. In some aspects, the method selects the first plurality of nodes. In some aspects, the network comprises a plurality of ISPs with respective pluralities of nodes and the respective pluralities of nodes comprises the first plurality of nodes. In some aspects, displaying a first plurality of nodes, edges, and latency is independent of cooperation from the plurality of ISPs. In some aspects, the method gathers information regarding the first plurality of nodes from vantage points outside the first plurality of nodes.