Abstract: The invention broadly comprises a method and service of visualization of Internet nodes involved in distributed electronic crime in order to see patterns of actionable intelligence, such as multiple phishing nodes hosted at the same hosting center, or domain names registered in one country that are actually in another country or nodes related by one or more aspects, such as specific criminal attack campaign, target or technical weakness exploited to ease commandeering of the node. The invention involves collecting topological and latency data including changes over time and using the data to determine probable topological and geographical locations of single or multiple nodes, as well as inferential geolocation.

Abstract: The invention broadly comprises a method for determining financial loss related to performance of an internetwork. The method correlates input information regarding performance of an internetwork to operations of a financial entity underwriting insurance premiums and bonds and translates the correlated input information into at least one operational risk for the entity. In some aspects, the internetwork is the Internet. The method gathers secondary external information other than directly from the internetwork, correlates the input and secondary external information, and translates the correlated input and secondary external information into at least one operational risk for the entity. For at least one subset and one peril, the method determines a spread in time and space of effects of the at least one anomaly and peril on the internetwork and on the at least one subset.