Patent ID: 11895090
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 31:
32. A network-enabled threat mitigation system comprising:
a first computing system comprising at least a first processor and at least a first non-transitory computer readable storage medium having encoded thereon first instructions that when executed by the at least the first processor cause the first computing system to perform a first process including:
enabling a first virtual private network internet point of presence (“VPN internet PoP”);
connecting a plurality of VPN tunnels to an internet via the first VPN internet PoP;
determining a plurality of technical indicators associated with the plurality of VPN tunnels; and
transmitting the plurality of technical indicators associated with the plurality of VPN tunnels;
a second computing system comprising at least a second processor and at least a second non-transitory computer readable storage medium having encoded thereon second instructions that when executed by the at least the second processor cause the second computing system to perform a second process including:
enabling a second virtual private network internet point of presence (“VPN internet PoP”); and
enabling use of the second VPN internet PoP by a plurality of sources comprising a plurality of clients;
a third computing system in network communication with the first computing system and the second computing system, the third computing system comprising at least a third processor and at least a third non-transitory computer readable storage medium having encoded thereon third instructions that when executed by the at least the third processor cause the third computing system to perform a third process including:
accessing a first intelligence feed comprising a plurality of cybersecurity incidents, including at least one of threats or attacks, observed on at least one internet-connected computing system and respective indications of from where the plurality of cybersecurity incidents originated;
receiving from the first computing system the plurality of technical indicators;
generating a second intelligence feed comprising the plurality of technical indicators;
comparing the first intelligence feed to the second intelligence feed;
determining a particular incident of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed to the second intelligence feed;
determining a time frame of the particular incident based on at least one of the first intelligence feed or the second intelligence feed;
monitoring the use of the second VPN internet PoP by the plurality of sources comprising the plurality of clients to determine a plurality of time-based behaviors;
comparing the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident to determine a match of a particular behavior of the plurality of time-based behaviors from a particular source comprising a particular client of the plurality of sources to the particular incident; and
blocking the particular source at the second VPN internet PoP based on the determination of the match of the particular behavior from the particular source to the particular incident.