Discovering yet unknown malicious entities using relational data

An apparatus, comprising:

• a network interface;
• and
• a processor, wherein the processor is configured to:
• collect data from a database arrangement about behavior of observed entities observed operating in a network, wherein the collected data includes one or more features associated with the observed entities;
• generate a probabilistic model that correlates the one or more features with malicious and/or benign behavior of the observed entities;
• collect data from the database arrangement for unobserved entities that have not been observed operating in the network and that have at least one common feature with at least one of the observed entities;
• generate, from the probabilistic model, a numerical confidence level that one of the unobserved entities is a malicious entity prior to receiving packets sent from the one of the unobserved entities;
• determine a numerical threshold for the probabilistic model such that a deviation of the numerical confidence level from the numerical threshold is indicative that the one of the unobserved entities is malicious;
• determine from the probabilistic model that the one of the unobserved entities is a malicious entity;
• include the one of the unobserved entities as a malicious entity on a blacklist prior to receiving the packets sent from the one of the unobserved entities;
• and
• apply, via the network interface, network policies to the packets sent from the one of the unobserved entities based upon the blacklist.

A tangible, non-transitory computer readable medium encoded with instructions, wherein the instructions, when executed by a processor, cause the processor to:

• collect data from a database arrangement about behavior of observed entities observed operating in a network, wherein the collected data includes one or more features associated with the observed entities;
• generate a probabilistic model that correlates the one or more features with malicious and/or benign behavior of the observed entities;
• collect data from the database arrangement for unobserved entities that have not been observed operating in the network and that have at least one common feature with at least one of the observed entities;
• generate, from the probabilistic model, a numerical confidence level that one of the unobserved entities is a malicious entity prior to receiving packets sent from the one of the unobserved entities;
• determine a numerical threshold for the probabilistic model such that a deviation of the numerical confidence level from the numerical threshold is indicative that the one of the unobserved entities is malicious;
• determine from the probabilistic model that the one of the unobserved entities is a malicious entity;
• include the one of the unobserved entities as a malicious entity on a blacklist prior to receiving the packets sent from the one of the unobserved entities;
• and
• apply, via a network interface, network policies to the packets sent from the one of the unobserved entities based upon the blacklist.