Patent ID: 11895090
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 27:
28. The method of claim 1, further comprising:
determining certain incidents of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed and the second intelligence feed;
determining respective time frames of the certain incidents based on the at least one of the first intelligence feed or the second intelligence feed;
monitoring use of certain VPN internet PoPs by the plurality of sources comprising the plurality of clients to further determine the plurality of time-based behaviors;
comparing the plurality of time-based behaviors to the certain incidents and to the respective time frames of the certain incidents to determine matches of certain behaviors of the plurality of time-based behaviors from certain sources of the plurality of sources to the certain incidents respectively;
blocking the certain sources at the certain VPN internet PoPs based on the determination of the matches of the certain behaviors from the certain sources to the certain incidents respectively; and
providing indications of the certain behaviors and the certain VPN internet PoPs and the blocking of the certain sources at the certain VPN internet PoPs.