System and method for analyzing relationships between clusters of electronic devices to counter cyberattacks

A system for analyzing relationships between clusters of devices, the system comprising:

• a hardware processor configured to:
• select a first device from a first cluster of devices and selecting a second device from a second cluster of devices;
• obtain information related to a first communication link associated with the first device and obtaining information related to a second communication link associated with the second device;
• compute a similarity metric representing a similarity between the first communication link and the second communication link based on the obtained information;
• determine a relationship between the first cluster and the second cluster using the computed similarity metric;
• generate an intercluster link profile using the computed similarity metric, the intercluster link profile indicating information based on which the relationship between the first cluster and the second cluster was determined;
• and
• when a cyberattack is detected on one of the devices in the first cluster or the second cluster, modify protection of all devices in the first cluster and the second cluster based on the determined relationship and based on the intercluster link profile in order to defend the first cluster and the second cluster from the cyberattack.

A non-transitory computer readable medium storing thereon computer executable instructions for analyzing relationships between clusters of devices, including instructions for:

• selecting a first device from a first cluster of devices and selecting a second device from a second cluster of devices;
• obtaining information related to a first communication link associated with the first device and obtaining information related to a second communication link associated with the second device;
• computing a similarity metric representing a similarity between the first communication link and the second communication link based on the obtained information;
• determining a relationship between the first cluster and the second cluster using the computed similarity metric;
• generating an intercluster link profile using the computed similarity metric, the intercluster link profile indicating information based on which the relationship between the first cluster and the second cluster was determined;
• and
• when a cyberattack is detected on one of the devices in the first cluster or the second cluster, modifying protection of all devices in the first cluster and the second cluster based on the determined relationship and based on the intercluster link profile in order to defend the first cluster and the second cluster from the cyberattack.