Patent ID: 11895090
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 30:
31. A non-transitory computer readable storage medium having computer-executable instructions that when executed cause one or more processors to perform operations comprising:
accessing a first intelligence feed comprising a plurality of cybersecurity incidents, including at least one of threats or attacks, observed on at least one internet-connected computing system and respective indications of from where the plurality of cybersecurity incidents originated;
generating a second intelligence feed comprising a plurality of technical indicators defined on at least one virtual private network internet point of presence (“VPN internet PoP”) that connects a plurality of VPN tunnels to an internet;
comparing the first intelligence feed to the second intelligence feed;
determining a particular incident of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed and the second intelligence feed;
determining a time frame of the particular incident based on at least one of the first intelligence feed or the second intelligence feed;
monitoring use of a particular VPN internet PoP by a plurality of sources comprising a plurality of clients to determine a plurality of time-based behaviors;
comparing the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident to determine a match of a particular behavior of the plurality of time-based behaviors from a particular source comprising a particular client to the particular incident; and
blocking the particular source at the particular VPN internet PoP based on the determination of the match of the particular behavior from the particular source to the particular incident.