Abstract: A computer-implemented method includes receiving CTI from a data source during a search of a system, and capturing the CTI in a STIX bundle. The method includes invoking an analytic pipeline on the STIX bundle that includes applying a classification model on the STIX bundle to classify features from the CTI and applying a clustering model on the STIX bundle to identify a cluster of features from the CTI. The output of the analytic pipeline is analyzed to identify suspicious features that include a combination of the classified features and the cluster of features. The suspicious features are annotated thereby highlighting risk and threat, and attack techniques are identified using existing domain expertise encoded as heuristics to provide additional machine learning features.

Abstract: An approach is provided that automatically classify network traffic of web applications and services based on a dynamic analysis. The approach scans a resource that corresponds to a named network application and receives, as a result of the scan, network resource identifiers that are accessed by the named network application. Network traffic between users and network resources is monitored, with the monitoring resulting in a set of visited network resource identifiers. The set of resource identifiers is found by matching the visited network resource identifiers with the network resource identifiers returned by the scan. Each of the set of resource identifiers is then matched with the named application.

Abstract: An approach is provided that automatically classify network traffic of web applications and services based on a dynamic analysis. The approach scans a resource that corresponds to a named network application and receives, as a result of the scan, network resource identifiers that are accessed by the named network application. Network traffic between users and network resources is monitored, with the monitoring resulting in a set of visited network resource identifiers. The set of resource identifiers is found by matching the visited network resource identifiers with the network resource identifiers returned by the scan. Each of the set of resource identifiers is then matched with the named application.

Abstract: An approach is provided that automatically classify network traffic of web applications and services based on a dynamic analysis. The approach scans a resource that corresponds to a named network application and receives, as a result of the scan, network resource identifiers that are accessed by the named network application. Network traffic between users and network resources is monitored, with the monitoring resulting in a set of visited network resource identifiers. The set of resource identifiers is found by matching the visited network resource identifiers with the network resource identifiers returned by the scan. Each of the set of resource identifiers is then matched with the named application.

Abstract: An approach is provided that automatically classify network traffic of web applications and services based on a dynamic analysis. The approach scans a resource that corresponds to a named network application and receives, as a result of the scan, network resource identifiers that are accessed by the named network application. Network traffic between users and network resources is monitored, with the monitoring resulting in a set of visited network resource identifiers. The set of resource identifiers is found by matching the visited network resource identifiers with the network resource identifiers returned by the scan. Each of the set of resource identifiers is then matched with the named application.