Abstract: Systems and methods for dynamically learning network environments to achieve adaptive security are described. One described method for setting an adaptive threshold for a node includes: monitoring a data stream associated with the node to identify a characteristic of the node; monitoring an environmental factor capable of affecting the node; and determining the adaptive threshold based on at least one of the characteristic or the environmental factor. Another described method for dynamically assessing a risk associated with network traffic includes: identifying a communication directed at the node; determining a risk level associated with the communication; and comparing the risk level to the adaptive threshold.

Abstract: Systems and methods for dynamic and risk-aware network security are described. In one embodiment, a system dynamically assesses whether a connection over a communications medium (102) is anomalous (suspicious, malicious, deviating from normal behavior, fits a certain profile or pattern, or has the potential to be any one of these) and generates an appropriate response depending on whether the connection is deemed to be normal or anomalous for a specified period of time. The types of responses include, but are not limited to, blocking the source of the connection from connecting to its intended destination, altering the destination of the connection, auditing the connection, or any combination of these.

Abstract: Systems and methods for an information system security infrastructure are described. One embodiment of the present invention comprises global Internet-scale defense infrastructure, referred to as the Intrusion Detection Force (IDF). The IDF comprises a virtual infrastructure implemented on top of an existing network, such as the Internet. The IDF enables secure information sharing and intelligent data analysis and response. The node (e.g. 102 of FIG. 1) is the most primitive entity in the IDF architecture, and may be a switch, router, server, or workstation. The IDF may be implemented in small networks of computers or may be utilized by millions of hosts throughout the Internet, spanning different organizations, countries, and continents.