Recursive multi-layer examination for computer network security remediation

An analytic engine comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions executable by the processor to perform the following operations for recursive multi-layer examination for computer network security remediation:
• identifying one or more first communications originating from or directed to a first node;
• identifying at least one of a protocol and an application used for each of the one or more first communications;
• examining each of the one or more first communications for malicious behavior using a respective first scanlet of one or more scanlets, the respective first scanlet associated with the at least one of the protocol and the application used for the each of the one or more first communications;
• receiving a first risk score from the respective first scanlet for each of the one or more first communications responsive to the examining of the each of the one or more first communications;
• determining the first risk score associated with one of the one or more first communications exceeds a first predetermined threshold;
• indicating the first node and a second node in communication with the first node via the one of the one or more first communications are malicious;
• identifying one or more second communications originating from or directed to the second node;
• identifying at least one of a protocol and an application used for each of the one or more second communications;
• examining each of the one or more second communications for malicious behavior using a respective second scanlet of the one or more scanlets, the respective second scanlet associated with the at least one of the protocol and the application used for the each of the one or more second communications;
• receiving a second risk score from the respective second scanlet for each of the one or more second communications responsive to the examining of the each of the one or more second communications;
• determining the second risk score associated with one of the one or more second communications exceeds the first predetermined threshold;
• indicating a third node in communication with the second node via the one of the one or more second communications is malicious;
• providing the indicated malicious nodes and communications originating from or directed to the indicated malicious nodes, such that progress of a security breach or intrusion through the indicated malicious nodes and the communications is indicated;
• remediating the security breach;
• assigning a node risk score to an additional second node in which additional second risk scores, for additional second communications originating from or directed to the additional second node, do not exceed the first predetermined threshold, the node risk score being an average of the additional second risk scores;
• and
• determining the node risk score exceeds a second predetermined threshold and
• indicating the additional second node is malicious.

A computer-implemented method for recursive multi-layer examination for computer network security remediation comprising:

• retrieving first metadata using a first identifier associated with a first node, the first metadata comprising at least one of a source (IP) address and/or hostname, source port, destination (IP) address and/or hostname, destination port, protocol, application, username and/or other credentials used to gain access to computing resources on a network, and number of bytes in a communication;
• identifying one or more first communications originating from or directed to the first node using the first metadata;
• ascertaining a first characteristic of each of the one or more first communications using the first metadata;
• selecting a respective first scanlet of a plurality of scanlets, the respective first scanlet using the first characteristic of a respective first communication of the one or more first communications;
• applying the respective first scanlet to the respective first communication;
• receiving a first risk score for each of the one or more first communications responsive to the applying of the respective first scanlet;
• determining the first risk score associated with one of the one or more first communications exceeds a first predetermined threshold;
• indicating the first node and a second node in communication with the first node via the one of the one or more first communications are malicious;
• retrieving second metadata using a second identifier associated with the second node, the second metadata comprising at least one of a source (IP) address and/or hostname, source port, destination (IP) address and/or hostname, destination port, protocol, application, username and/or other credentials used to gain access to computing resources on a network, and number of bytes in a communication;
• identifying one or more second communications originating from or directed to the second node using the second metadata;
• ascertaining a second characteristic of each of the one or more second communications using the second metadata;
• selecting a respective second scanlet of the plurality of scanlets, the respective second scanlet using the second characteristic of a respective second communication of the one or more second communications;
• applying the respective second scanlet to the respective second communication;
• receiving a second risk score for each of the one or more second communications responsive to the applying of the respective second scanlet;
• determining the second risk score associated with one of the one or more second communications exceeds the first predetermined threshold;
• indicating a third node in communication with the second node via the one of the one or more second communications is malicious;
• providing the indicated malicious nodes and communications originating from or directed to the indicated malicious nodes, such that progress of a security breach or intrusion through the indicated malicious nodes and communications is indicated;
• remediating the security breach;
• assigning a node risk score to an additional second node in which additional second risk scores, for additional second communications originating from or directed to the additional second node, do not exceed the first predetermined threshold, the node risk score being an average of the additional second risk scores;
• and
• determining the node risk score exceeds a second predetermined threshold and indicating the additional second node is malicious.