Abstract: A system and method for enriching a reputation database is provided. The system and method comprise: receiving attack attributes associated with an attack campaign; extracting an attack behavior profile for an identity linked to the attack campaign, wherein the attack behavior profile is based on the received attack attributes; retrieving, from a reputation database, behavior profiles of known bad actor groups, wherein bad actor groups are collections of network identities identified for engaging in malicious cyber activity; determining similarity scores between the extracted attack behavior profile and the behavior profiles of each known bad actor group; and enriching the reputation database by updating, based on the determined similarity scores, the extracted attack behavior profile and the behavior profiles of known bad actor groups stored in the reputation database.

Abstract: A method and system for mitigating encrypted distributed denial of service (DDOS) attacks comprising: receiving a detection of an encrypted DDOS attack from an encrypted transaction related traffic, wherein the encrypted DDOS attack is associated with a plurality of transport layer security (TLS) fingerprints (FPs); classifying each of the plurality of TLS FPs as a type of FP based on a comparison of rate-invariant values to a native FP baseline, wherein the rate-invariant values are associated with the plurality of TLS FPs; selecting anomalous FPs as a subset of the plurality of TLS FPs; generating a real time signature (RTS), for the encrypted DDOS attack, having at least one unknown type of FP of the subset of anomalous FPs; and mitigating the encrypted DDOS attack based on the generated RTS.

Abstract: A method and system for mitigating encrypted distributed denial of service (DDoS) attacks comprising: receiving a detection of an encrypted DDoS attack from an encrypted transaction related traffic, wherein the encrypted DDoS attack is associated with a plurality of transport layer security (TLS) fingerprints (FPs); classifying each of the plurality of TLS FPs as a type of FP based on a comparison of rate-invariant values to a native FP baseline, wherein the rate-invariant values are associated with the plurality of TLS FPS; selecting anomalous FPs as a subset of the plurality of TLS FPs; generating a real time signature (RTS), for the encrypted DDoS attack, having at least one unknown type of FP of the subset of anomalous FPs; and mitigating the encrypted DDoS attack based on the generated RTS.

Abstract: A method and system for detecting encrypted distributed denial of service (DDOS) attacks are provided. The system includes monitoring encrypted transactions related traffic; deriving from the encrypted transactions rate-based parameters and rate-invariant parameters, wherein the rate-based parameters and rate-invariant parameters are associated with transport layer security (TLS) fingerprints; comparing values of the rate-based parameters and the rate-invariant parameters respectively to at least one rate-based anomaly threshold and at least one rate-invariant anomaly threshold; and declaring a detected encrypted DDOS attack when both the rate-based anomaly threshold and the rate-invariant anomaly threshold are exceeded.