Patent ID: 11968235
Assignee: QOMPLX LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A system for cybersecurity analysis and protection using distributed computing services, comprising:
a cloud computing platform comprising a hardware memory, a hardware processor, and a non-volatile storage device;
an in-memory associative array stored in the hardware memory;
a cloud-based storage bin stored on the non-volatile storage device;
a proxy server operating on the cloud computing platform configured to act as a public-facing proxy network, the public-facing proxy network comprising one or more selectable attribute nodes;
a user application comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the cloud computing platform to:
receive a domain name for reconnaissance and scoring;
create a first queue of Internet search tasks for the domain name using an in-memory associative array service, the search tasks comprising searches for, and receipt of search results for, one or more domain name system records;
implement the first queue of Internet search tasks through the one or more selectable attribute nodes of the public-facing proxy network;
identify Internet protocol addresses associated with the domain name from the one or more domain name system records;
create a second queue of Internet protocol address scanning tasks for the identified Internet protocol addresses, the scanning tasks comprising an open port scan for each Internet protocol address identified and a vulnerability scan for each open port;
implement the second queue of Internet protocol address scanning tasks and receive a list of open ports, associated vulnerabilities, and a baseline and service fingerprint profile for the domain name;
create a third queue of Internet protocol address scanning tasks for the identified Internet protocol addresses, the scanning tasks comprising a port scan detection task for each Internet protocol address identified;
implement the third queue of Internet protocol address scanning tasks wherein a data packet associated with a detected port scan is sent to a data packet modifier; and
store the search results received from the first queue of Internet search tasks and the list of open ports, associated vulnerabilities, and baseline and service fingerprint profile from the second queue of Internet protocol address scanning tasks;

a distributed data processing engine comprising a second plurality of programming instructions stored in the memory which, when operating on the processor, causes the cloud computing platform to:
receive a cybersecurity scoring model, the cybersecurity scoring model comprising category weights for the one or more domain name system records, the list of open ports, and associated vulnerabilities and further comprising an algorithm for combining the categories using the category weights;
calculate a cybersecurity score by applying the algorithm to the weighted categories; and
generate a cybersecurity portion of the baseline and service fingerprint profile for the domain name based on the cybersecurity score; and

the data packet modifier comprising a third plurality of programming instructions stored in the memory which, when operating on the processor, causes the cloud computing platform to:
receive the data packet associated with a detected port scan;
generate and send a reply data packet with a modified header, the modified header comprising a flag and a bad sequence number to compel a sniffing machine to return a response data packet, the response data packet revealing the sniffing machine's Internet protocol address; and
block the sniffing machine's Internet protocol address.