Analysis of historical network traffic to identify network vulnerabilities

A non-transitory computer readable storage medium having embodied thereon a program executable by a processor to implement a method for characterizing spread of malware, the method comprising:

• receiving a set of computer data at an analysis computer operatively connected to a computer network, the set of computer data including instructions executable by a processor of a computing device of the computer network;
• classifying the instructions included in the set of computer data as a new set of malware program code based on an identification that one or more actions performed by an execution of the instructions by the processor are malicious, wherein the one or more actions are identified as causing a particular type of damage;
• identifying a set of requirements for detecting the new set of malware program code, the identification of the set of requirements based on the one or more actions performed by the execution of the instructions and the particular type of the damage;
• generating data associated with the set of requirements, wherein the data includes a visualization that identifies a malware type corresponding to the new set of malware program code, wherein the data includes malware data from a plurality of locations received at the analysis computer, and wherein the visualization includes visual indicators of detection locations of the malware type and malware vectors indicating paths of transmission of the malware type;
• and
• sending the generated data to one or more assets such that the one or more assets can detect the new set of malware program code, wherein the one or more assets include a plurality of devices of the computer network.

A system for characterizing spread of malware, the system comprising:

• an analysis computer operatively connected to a computer network that:
• receives a set of computer data that includes instructions executable by a computing device of the computer network,
• classifies the instructions included in the set of computer data as a new set of malware program code based on an identification that one or more actions performed by the execution of the instructions are malicious, wherein the one or more actions are identified as causing a particular type of damage,
• identifies a set of requirements for detecting the new set of malware program code, the identification of the set of requirements based on the one or more actions performed by the execution of the instructions and the particular type of the damage,
• generates data associated with the set of requirements, wherein the data includes a visualization that identifies a malware type corresponding to the new set of malware program code, wherein the data includes malware data from a plurality of locations received at the analysis computer, and wherein the visualization includes visual indicators of detection locations of the malware type and malware vectors indicating paths of transmission of the malware type, and
• sends the generated data to one or more assets such that the one or more assets can detect the new set of malware program code, wherein the one or more assets include a plurality of devices of the computer network.