Abstract: Approaches presented herein relate to the monitoring of network traffic, and identification of potentially malicious behavior, in a networked resource environment. Values for key features of interest can be extracted from monitored network traffic. This data can be aggregated for one or more data dimensions, such as for a given region, and modeling can be performed to generate distributions for those values in that region. A threshold can be applied to this distribution to identify anomalous activity, where the same threshold can be applied to distributions for different regions and the values that meet or exceed that threshold will differ across regions based at least in part upon different levels of activity or different behavior. Such an approach scales with changes in the amount or type of traffic to be monitored, and can handle very large numbers of resources and volumes of traffic. If potentially malicious behavior is identified, one or more remedial or mitigation actions may be taken.

Abstract: Described are systems and methods for determining a reputation score and/or a confidence score for a network identifier that represents, respectively, a likelihood that the network identifier presents a threat and/or a likelihood that the network activity associated with the network identifier corresponds to a port scanning, enumeration, or other malicious event. Embodiments of the present disclosure can utilize various network telemetry information, such as authentication activity, outbound traffic activity, web activity, honeypot connection activity, or network classification information to determine the reputation and/or confidence scores in response to a query/request and/or in connection with potentially malicious activity that can represent a likelihood that the detected potentially malicious activity is malicious/legitimate and the potential impact that remediation measures taken against the network identifier may have in the event that the detected network activity was legitimate.

Abstract: Methods and systems for the detection, identification, analysis of cybersecurity events in order to support prevention of the persistence of threats, malware or other harmful events are provided. The methods and systems of the present invention enable a user to find similar anomalous network traffic within a single network or across multiple networks. The methods and systems identify and correlate activity in order to analyze potential threats within a network by providing broader contextual information about how those threats relate to other activity within the network or across a sector or country.

Abstract: Methods and systems for the detection, identification, analysis of cybersecurity events in order to support prevention of the persistence of threats, malware or other harmful events are provided. The methods and systems of the present invention enable a user to find similar anomalous network traffic within a single network or across multiple networks. The methods and systems identify and correlate activity in order to analyze potential threats within a network by providing broader contextual information about how those threats relate to other activity within the network or across a sector or country.

Abstract: Methods and systems for the detection, identification, analysis of cybersecurity events in order to support prevention of the persistence of threats, malware or other harmful events are provided. The methods and systems of the present invention enable a user to find similar anomalous network traffic within a single network or across multiple networks. The methods and systems identify and correlate activity in order to analyze potential threats within a network by providing broader contextual information about how those threats relate to other activity within the network or across a sector or country.

Abstract: Methods and systems for the detection, identification, analysis of cybersecurity events in order to support prevention of the persistence of threats, malware or other harmful events are provided. The methods and systems of the present invention enable a user to find similar anomalous network traffic within a single network or across multiple networks. The methods and systems identify and correlate activity in order to analyze potential threats within a network by providing broader contextual information about how those threats relate to other activity within the network or across a sector or country.

Abstract: Methods and systems for the detection, identification, analysis of cybersecurity events in order to support prevention of the persistence of threats, malware or other harmful events are provided. The methods and systems of the present invention enable a user to find similar anomalous network traffic within a single network or across multiple networks. The methods and systems identify and correlate activity in order to analyze potential threats within a network by providing broader contextual information about how those threats relate to other activity within the network or across a sector or country.