Abstract: The invention broadly comprises a method and service of visualization of Internet nodes involved in distributed electronic crime in order to see patterns of actionable intelligence, such as multiple phishing nodes hosted at the same hosting center, or domain names registered in one country that are actually in another country or nodes related by one or more aspects, such as specific criminal attack campaign, target or technical weakness exploited to ease commandeering of the node. The invention involves collecting topological and latency data including changes over time and using the data to determine probable topological and geographical locations of single or multiple nodes, as well as inferential geolocation.

Abstract: The invention broadly comprises a method for determining financial loss related to performance of an internetwork. The method correlates input information regarding performance of an internetwork to operations of a financial entity underwriting insurance premiums and bonds and translates the correlated input information into at least one operational risk for the entity. In some aspects, the internetwork is the Internet. The method gathers secondary external information other than directly from the internetwork, correlates the input and secondary external information, and translates the correlated input and secondary external information into at least one operational risk for the entity. For at least one subset and one peril, the method determines a spread in time and space of effects of the at least one anomaly and peril on the internetwork and on the at least one subset.

Abstract: The invention broadly comprises a computer-based method for presenting information regarding network performance and topology. The steps of the method include: displaying a first plurality of nodes in the network; displaying edges associated with the first plurality of nodes; and, displaying latency associated with the edges. The preceding steps, and those that follow, are performed by at least one general-purpose computer specially programmed to perform these steps. In some aspects, the method selects the first plurality of nodes. In some aspects, the network comprises a plurality of ISPs with respective pluralities of nodes and the respective pluralities of nodes comprises the first plurality of nodes. In some aspects, displaying a first plurality of nodes, edges, and latency is independent of cooperation from the plurality of ISPs. In some aspects, the method gathers information regarding the first plurality of nodes from vantage points outside the first plurality of nodes.

Abstract: A method for measuring the performance of a large computer network is defined. The method provides a method of defining and characterizing the population of interest and interesting sub-populations; a method of providing a sampling list of nodes that represent the population; measuring the performance of destinations in the sampling list; recording raw data therefrom; reducing the raw data and providing presentations of information indicative of one or more of the sub-populations in ways that address questions of interest.

Abstract: A method for monitoring of network performance is defined. The method includes the steps of defining and characterizing the population of interest (the set of hosts and networks in which there is interest); choosing a set of destinations that represent the population (pinglists) including categorization structure (viewlists); monitoring the destinations in the pinglists from one or more vantage points (beacons) and collecting information therefrom; compiling and summarizing the data in ways that address questions of interest about the population; and providing an appropriate interpretation of the analysis in terms of the questions of interest.

Abstract: A method and system for monitoring the internet is defined. An embodiment of the invention invovles the following steps: providing a traceroute specification and a set of global defaults; parsing the specification into its constituent parts; setting up a transaction request message; creating a TCP/IP socket and setting up input/output access to it; and for each potential “hop” up to the maximum allowed, sending a “ping” to the destination with the max allowed hops for that “ping” and setting the message to one more than the ping to the previous potential hop (where the numbering started at one); noting the timestamp for that ping transmission; waiting for a reply from the ping; noting the timestamp for that reply when it arrives and then calculate the time taken from transmit to reply; and closing the socket and server connection.

Abstract: A system and method for collecting operational data is defined. An input list is provided. While there are more destinations left in the input list, the next specification is read, that ping is performed while its performance is timed (described in more detail below), and, the measurements are written to a data log. The logic of the measurement for a given destination and a set of global defaults is performed by the steps of: parsing the specification into its constituent parts; setting up the transaction request message; creating a TCP/IP socket and setting up input/output access to it; sending a “ping” to the destination; noting the timestamp for that ping transmission; waiting for a reply from the ping; noting the timestamp for that reply when it arrives; and calculating the time taken from transmit to reply. The socket and server connection can then be closed.