Abstract: Disclosed, in one general aspect, is a network security system that includes pipeline storage operative to receive a series of malware samples. A sandboxed operating environment is responsive to the pipeline storage and operative to automatically retrieve successive malware samples from the pipeline storage, to run each of the malware samples in the sandboxed operating environment after it is retrieved, and to analyze at least some communication from each of the malware samples as they are run. A verdict output is responsive to the sandboxed operating environment to provide a verdict for malicious internet infrastructure associated with at least some of the malware samples run in the sandboxed operating environment.

Abstract: Disclosed, in one general aspect, is a network security system that includes a network traffic analysis tool operative to extract information about traffic with suspected attack support infrastructure addresses. An automated traffic pattern recognition tool is responsive to information extracted by the network traffic analysis tool and to enrichment data, and is operative to detect patterns in the extracted traffic information. An identification tool is responsive to the pattern recognition tool to identify victims associated with the suspected attack support infrastructure addresses based on patterns detected in the extracted traffic information. And the system includes storage that is responsive to the identification tool for storing the recorded suspected attack support infrastructure addresses and identified victims on an ongoing basis.

Abstract: A wireless network monitoring system is disclosed. In one general aspect, it includes a wireless network interface operative to access traffic on a wireless network that is connected to other devices and to a WAN access point, and capture logic responsive to the wireless network interface and operative to capture datagrams communicated between one or more of the other devices on the wireless network and the WAN access point. Inspection logic is responsive to the capture logic and operative to inspect the captured datagrams to detect conditions of concern related to the other devices on the wireless network, and conditional response logic is responsive to the inspection logic and operative to initiate actions in response to the detection of conditions of concern by the inspection logic.