Methods, systems, and media for detecting new malicious activity from IOT devices

A system for detecting malicious activity from Internet of Things (IoT) devices, the system comprising:

• a memory;
• and
• a hardware processor coupled to the memory that is configured to:
• receive, at a first time point from a first router connected to a first user device, first information indicating a first requested connection to a destination by the first user device that has been intercepted by the first router, wherein the first information indicates at least an identifier of the destination, and wherein, at the first time point, the first requested connection has not yet been classified as part of an attack;
• prior to allowing the first requested connection to the destination by the first user device:
• determine, using the first information, that the first requested connection to the destination by the first user device is part of an attack on the destination by the first user device and a plurality of other user devices, wherein determining that the first requested connection to the destination by the first user device is part of the attack on the destination comprises determining a count of a set of user devices including the first user device and the plurality of other user devices that have requested connections to the destination within a time window;
• and
• cause the first requested connection to be blocked in response to the determining that the first requested connection to the destination by the first user device is part of an attack on the destination;
• and
• cause a connection to the destination by a second user device to be blocked based on the determining that the first requested connection to the destination by the first user device is part of an attack on the destination.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting malicious activity, the method comprising:

• receiving, at a first time point at a server from a first router connected to a first user device, first information indicating a first requested connection to a destination by the first user device that has been intercepted by the first router, wherein the first information indicates at least an identifier of the destination, and wherein, at the first time point, the first requested connection has not yet been classified as part of an attack;
• prior to allowing the first requested connection to the destination by the first user device:
• determining, using the first information, that the first requested connection to the destination by the first user device is part of an attack on the destination by the first user device and a plurality of other user devices, wherein determining that the first requested connection to the destination by the first user device is part of the attack on the destination comprises determining a count of a set of user devices including the first user device and the plurality of other user devices that have requested connections to the destination within a time window;
• and
• causing the first requested connection to be blocked in response to the determining that the first requested connection to the destination by the first user device is part of an attack on the destination;
• and
• causing a connection to the destination by a second user device to be blocked based on the determining that the first requested connection to the destination by the first user device is part of an attack on the destination.