SYSTEMS AND PLATFORMS FOR INTELLIGENTLY MONITORING RISKY NETWORK ACTIVITIES

• US 20170006054A1
• Filed: 06/29/2016
• Published: 01/05/2017
• Est. Priority Date: 06/30/2015
• Status: Active Grant

• Current Assignee: Norse Networks, Inc.
• Original Assignee: Norse Networks, Inc.
• Inventors: STIANSEN, Tommy
• Granted Patent: US 9,923,914 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Technology for improving and monitoring data communication security is presented herein. The technology monitors a plurality of sources of risky activities, crawls on computer networks to scan the risky activities, visualizes the risky activities, and detects and prevents risky activities.

Claims

1. A computing system for improving data communication security, the system comprising:

(a) a digital processing device comprising a memory device and an operating system configured to perform executable instructions;

(b) a computer readable medium storing instructions executed by the digital processing device to provide an application, the application comprising;

(1) a monitoring module (i) receiving a plurality of sources of risky activities; and

(ii) crawling a computer network to scan the risky activities taking place on the computer network, wherein the plurality of sources comprises one or more domain names and one or more Internet protocol addresses and wherein at least a portion of the plurality of sources is inferred automatically by the monitoring module;

(2) a detection module using the plurality of sources and crawling results to detect the risky activities and infer potential risky sources; and

(3) a visualization module visualizing detected risky activities, the plurality of sources, and the potential risky sources.

2. The system of claim 1, wherein the plurality of sources further comprises at least one of the following:

one or more domain name systems, one or more passive domain systems, one or more webpages, one or more geolocations, one or more honeypots, one or more documents, one or more files, one or more network ports, one or more previously detected results.

3. The system of claim 1, wherein the plurality of sources is transmitted to the system from a website and from a honey pot.

4. The system of claim 1, wherein the plurality of sources is provided by a user.

5. The system of claim 1, wherein the plurality of sources is inferred automatically from past risky activities.

6. The system of claim 1, wherein the risky activities comprise one or more of the following:

virus, virus distribution, phishing, intrusion, an attack, malware, threat, fraud, identity theft, crime, cyberbullying, denial-of-service, hacking, digital piracy, intellectual property infringement, pornography production or distribution, controlled substance trade, terrorism, insurrection, smuggling, disobedience, money laundering, and unencrypted data communication.

7. The system of claim 1, wherein the risky activities comprise a series of risky activities.

8. The system of claim 1, wherein the computer network comprises one or more social networking media.

9. The system of claim 1, wherein the visualization module further visualizes the detected risky activities, the plurality of sources, and the potential risky sources in a geolocation.

10. The system of claim 1, wherein the visualization module further visualizes the detected risky activities, the plurality of sources, and the potential risky sources in a network layer.

11. The system of claim 1, wherein the detection module further identifies an indicator of compromise of the risky activities, prevents the risky activities, and removes the risky activities.

12. The system of claim 1, wherein the detection module comprises a search engine used to find a risky activity or a risky source based on a hash function, a file name, a uniform resource identifier (URL), a keyword, and a local geolocation.

13. The system of claim 1, further comprising one or more sensors, wherein the monitoring module receives a sensor signal from the one or more sensors and the sensor signal comprises a local risky activity.

14. The system of claim 1, wherein the application further comprises a recording module recording past risky activities, detection results, routing of risky activities, and context of risky activities.

15. The system of claim 14, wherein the context of risky activities comprises social context of risky activities.

16. Non-transitory computer-readable storage media encoded with a computer program including instructions executable by a digital processing device to create an application, the application comprising:

(a) a monitoring module (1) receiving a plurality of sources of risky activities; and

(2) crawling a computer network to scan the risky activities taking place on the computer network, wherein the plurality of sources comprises one or more domain names and one or more Internet protocol addresses and wherein at least a portion of the plurality of sources is inferred automatically by the monitoring module;

(b) a detection module using the plurality of sources and crawling results to detect the risky activities and infer potential risky sources; and

(c) a visualization module visualizing detected risky activities, the plurality of sources, and the potential risky sources.

17. The media of claim 16, wherein the plurality of sources further comprises at least one of the following:

one or more domain name systems, one or more passive domain systems, one or more webpages, one or more geolocations, one or more honeypots, one or more documents, one or more files, one or more network ports, one or more previously detected results.

18. The media of claim 16, wherein the plurality of sources is transmitted to the system from a website and from a honey pot.

19. The media of claim 16, wherein the plurality of sources is provided by a user.

20. The media of claim 16, wherein the plurality of sources is inferred automatically from past risky activities.

21. The media of claim 16, wherein the risky activities comprise one or more of the following:

virus, virus distribution, phishing, intrusion, an attack, malware, threat, fraud, identity theft, crime, cyberbullying, denial-of-service, hacking, digital piracy, intellectual property infringement, pornography production or distribution, controlled substance trade, terrorism, insurrection, smuggling, disobedience, money laundering, and unencrypted data communication.

22. The media of claim 16, wherein the risky activities comprise a series of risky activities.

23. The media of claim 16, wherein the computer network comprises one or more social networking media.

24. The media of claim 16, wherein the visualization module further visualizes the detected risky activities, the plurality of sources, and the potential risky sources in a geolocation.

25. The media of claim 16, wherein the visualization module further visualizes the detected risky activities, the plurality of sources, and the potential risky sources in a network layer.

26. The media of claim 16, wherein the detection module further identifies an indicator of compromise of the risky activities, prevents the risky activities, and removes the risky activities.

27. The media of claim 16, wherein the detection module comprises a search engine used to find a risky activity or a risky source based on a hash function, a file name, a uniform resource identifier (URL), a keyword, and a local geolocation.

28. The media of claim 16, further comprising one or more sensors, wherein the monitoring module receives a sensor signal from the one or more sensors and the sensor signal comprises a local risky activity.

29. The media of claim 16, wherein the application further comprises a recording module recording past risky activities, detection results, routing of risky activities, and context of risky activities.

30. The media of claim 29, wherein the context of risky activities comprises social context of risky activities.