Abstract: Disclosed are systems, methods, and non-transitory computer-readable storage media for identifying compromised computing devices in a computer network. A threat detection engine can gather network data describing performance of a secured computer network. The secured computer network can include a set of computing devices. The threat detection server can apply a set of threat detection algorithms to the network data to yield threat detection data for the secured computer network. The threat detection engine can then calculate, based on the threat detection data, a threat value for at least a first computing device from the set of computing devices. The threat value can indicate an estimated likelihood that the first computing device has been compromised and/or the severity of the compromise. The threat detection server can then present a visual representation of the threat value for at least the first computing device from the set of computing devices.

Abstract: The present invention collects raw packet data related to network traffic flow over the course of time. By combining metadata from the application layer and/or session layer with user and device identity data as well as indicators of a network threat that are received from threat feeds, information concerning pre-existing or post-mortem network incidents may be identified. Based on the nature of a particular network threat and a collective history of network traffic flow over the course of time, analytics may allow for identification of compromised users, files, and network nodes. Such an identification may in turn allow for removal, rehabilitation, or further investigation.