System and method to detect premium attacks on electronic networks and electronic devices

An attack classification system for detecting premium attacks, comprising:

• one or more hardware processors;
• and
• a storage medium that stores one or more software modules, including:
• data collection logic that, when executed by the one or more hardware processors, obtains analytic information from one or more resources remotely located from the attack classification system,
• mapping logic that, when executed by the one or more hardware processors and in accordance with a selected data model, generates logical representations, operating as objects, properties and relationships, for different portions of the analytic information represented as a nodal graph,
• filtering logic that, when executed by the one or more hardware processors, filters a first set of one or more relationships from the relationships and each of the first set of relationships providing lesser assistance in clustering the objects and the properties than a remaining plurality of relationships from the relationships,
• cluster formation logic that, when executed by the one or more hardware processors, performs a clustering operation by forming one or more clusters by removing a second set of one or more relationships from the remaining plurality of relationships, the one or more clusters includes a first cluster being a logical representation of a first plurality of objects of the objects, a first plurality of properties of the properties and a plurality of relationships being the remaining plurality of relationships excluding the second set of relationships,
• cluster analysis logic to analyze at least the first cluster of the one or more clusters to determine features of at least the first cluster and to introduce the determined features associated with the first cluster into the nodal graph, and
• classification logic to analyze the features of the first cluster to determine whether the first plurality of objects, the first plurality of properties and the plurality of relationships forming the first cluster are associated with a premium attack, the analyzing of the features of the first cluster comprises applying rule-based constraints to the features of at least the first cluster to determine that the features correspond to cluster features that are commonly present in premium attacks.

An attack classification system for detecting premium attacks, comprising:

• one or more hardware processors;
• and
• a storage medium that stores one or more software modules, including:
• data collection logic that, when executed by the one or more hardware processors, obtains analytic information from one or more resources remotely located from the attack classification system,
• mapping logic that, when executed by the one or more hardware processors and in accordance with a selected data model, generates logical representations, operating as objects, properties and relationships, for different portions of the analytic information represented as a nodal graph,
• filtering logic that, when executed by the one or more hardware processors, filters a first set of one or more relationships from the relationships and each of the first plurality of relationships providing lesser assistance in clustering the objects and the properties than a remaining plurality of relationships from the relationships,
• cluster formation logic that, when executed by the one or more hardware processors, performs a clustering operation by forming one or more clusters from removing one or more relationships of a plurality of relationships associated with logical representations of different portions of the analytic information, the logical representations of different portions of the analytic information are represented in accordance with a data model scheme as at least a plurality of objects,
• cluster analysis logic to analyze at least a first cluster of the one or more clusters to determine features of at least the first cluster and to introduce the determined features associated with the first cluster into the nodal graph, and
• classification logic to analyze the features of the first cluster to determine whether the plurality of objects and a remaining relationships of the plurality of relationships forming the first cluster are associated with a premium attack, the analyzing of the features of the first cluster comprises applying rule-based constraints to the features of at least the first cluster to determine that the features correspond to cluster features that are commonly present in premium attacks.