Abstract: A network compromise activity monitoring system includes a network connector, a compromise activity analyzer, and a compromise defender. The network connector has a public network port, at least one private network port, and an associated network connector traffic log concerning data packet traffic of the network connector. The compromise activity analyzer has access to suspect destination metadata, egress traffic metadata, and network device metadata, and is operative to determine a compromise activity level of one or more devices coupled to the at least one private network port. The compromise defender is responsive to the determined compromise activity level of the one or more devices and is operative to at least one of block, alert and notify in accordance with at least one rule.

Abstract: A system is provided for anonymously detecting and blocking threats within a telecommunications network. A network analyzer of the system may intercept traffic, or receive log files, related to traffic that passes over the network, collect metadata that includes values of data attributes associated with the traffic, interpret the metadata and therefrom generate and transmit a request for an associated threat score for the value of a data attribute, and receive the associated threat score and based thereon initiate a block or redirection of the traffic. A score requestor of the system may receive and serve the request by either returning the score from local storage or otherwise, generating and transmitting a secondary request to a scoring engine configured to calculate the associated threat score and the associated threat score to the score requestor to return to the network analyzer.

Abstract: A system is provided for anonymously detecting and blocking threats within a telecommunications network. A network analyzer of the system may intercept traffic, or receive log files, related to traffic that passes over the network, collect metadata that includes values of data attributes associated with the traffic, interpret the metadata and therefrom generate and transmit a request for an associated threat score for the value of a data attribute, and receive the associated threat score and based thereon initiate a block or redirection of the traffic. A score requestor of the system may receive and serve the request by either returning the score from local storage or otherwise, generating and transmitting a secondary request to a scoring engine configured to calculate the associated threat score and the associated threat score to the score requestor to return to the network analyzer.