Aggregating alerts of malicious events for computer security

A method by a computing device implementing an attack analyzer for processing malicious events detected by a firewall communicatively coupled between clients and a server, wherein the firewall is configured to block requests associated with malicious events from reaching the server or generate an alert describing the requests associated with the malicious events, wherein the firewall is further configured to allow requests that are determined to be legitimate to reach the server, the method comprising:

• receiving a batch of a plurality of malicious events detected by the firewall;
• determining a first set of features describing the plurality of malicious events;
• determining a first plurality of distances using a first non-Euclidean distance function, the first plurality of distances indicating levels of similarity between the first set of features of the plurality of malicious events, wherein the first non-Euclidean distance function is used to determine geographic origin similarity between different Internet Protocol (IP) addresses included in the first set of features;
• generating a first plurality of clusters according to the levels of similarity indicated by the first plurality of distances, wherein the first plurality of clusters includes a cluster that includes malicious events that are determined to be similar in terms of geographic origin;
• and
• transmitting information describing the first plurality of clusters to a management console for presentation to an administrator on a graphical user interface, wherein the information describing the first plurality of clusters indicates a common geographic origin associated with the malicious events included in the cluster.

A computer program product comprising a non-transitory computer readable storage medium having instructions encoded thereon that, when executed by a processor of a computing device implementing an attack analyzer, cause the processor to:

• determine a first set of features describing a malicious event detected by a firewall communicatively coupled between clients and a server, wherein the firewall is configured to block requests associated with the malicious event from reaching the server or generate an alert describing the requests associated with the malicious events, wherein the firewall is further configured to allow requests that are determined to be legitimate to reach the server;
• determine a set of distances using a non-Euclidean distance function and the first set of features, the set of distances indicating levels of similarity between the first set of features and a second set of features, wherein the non-Euclidean distance function is used to determine geographic origin similarity between different Internet Protocol (IP) addresses included in the first set of features and second set of features;
• generate a statistical distribution object using the set of distances, the statistical distribution object including information describing a cluster that includes at least the malicious event and one or more other malicious events that are determined to be similar to the malicious event in terms of geographic origin;
• store information describing the statistical distribution object;
• and
• transmit information describing the cluster to a management console for presentation to an administrator on a graphical user interface, wherein the information describing the cluster indicates a common geographic origin associated with the malicious events included in the cluster.