Patent ID: 11968235
Assignee: QOMPLX LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 1:
2. A method for cybersecurity analysis and protection using distributed computing services, comprising the steps of:
receiving a domain name for reconnaissance and scoring;
creating a first queue of Internet search tasks for a domain name using an in-memory associative array service, the search tasks comprising searches for, and receipt of search results for, one or more domain name system records;
implementing the first queue of Internet search tasks through one or more selectable attribute nodes of a public-facing proxy network;
identifying Internet protocol addresses associated with the domain name from the one or more domain name system records;
creating a second queue of Internet protocol address scanning tasks for the identified Internet protocol addresses, the scanning tasks comprising an open port scan for each Internet protocol address identified and a vulnerability scan for each open port;
implementing the second queue of Internet protocol address scanning tasks and receiving a list of open ports, associated vulnerabilities, and a baseline and service fingerprint profile for the domain name;
creating a third queue of Internet protocol address scanning tasks for the identified Internet protocol addresses, the scanning tasks comprising a port scan detection task for each Internet protocol address identified;
implementing the third queue of Internet protocol address scanning tasks wherein a data packet associated with a detected port scan is sent to a data packet modifier;
storing the search results received from the first queue of Internet search tasks and the list of open ports, associated vulnerabilities, and baseline and service fingerprint profile from the second queue of Internet protocol address scanning tasks;
receiving a cybersecurity scoring model, the cybersecurity scoring model comprising category weights for the one or more domain name system records, the list of open ports, and associated vulnerabilities and further comprising an algorithm for combining the categories using the category weights;
calculating a cybersecurity score by applying the algorithm to the weighted categories;
generating a cybersecurity portion of the baseline and service fingerprint profile for the domain name based on the cybersecurity score;
receiving at the data packet modifier the data packet associated with a detected port scan;
generating and sending a reply data packet with a modified header, the modified header comprising a flag and bad sequence number to compel a sniffing machine to return a response data packet, the response data packet revealing the sniffing machine's Internet protocol address; and
blocking the sniffing machine's Internet protocol address.