Privacy preserving malicious network activity detection and mitigation

A non-transitory computer readable storage medium having computer-executable instructions that when executed cause one or more processors to perform operations comprising:

• accessing a first intelligence feed comprising a plurality of cybersecurity incidents, including at least one of threats or attacks, observed on at least one internet-connected computing system and respective indications of from where the plurality of cybersecurity incidents originated;
• generating a second intelligence feed comprising a plurality of technical indicators defined on at least one virtual private network internet point of presence (“VPN internet PoP”) that connects a plurality of VPN tunnels to an internet;
• comparing the first intelligence feed to the second intelligence feed;
• determining a particular incident of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed and the second intelligence feed;
• determining a time frame of the particular incident based on at least one of the first intelligence feed or the second intelligence feed;
• monitoring use of a particular VPN internet PoP by a plurality of sources comprising a plurality of clients to determine a plurality of time-based behaviors;
• comparing the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident to determine a match of a particular behavior of the plurality of time-based behaviors from a particular source comprising a particular client to the particular incident;
• and
• blocking the particular source at the particular VPN internet PoP based on the determination of the match of the particular behavior from the particular source to the particular incident.

A network-enabled threat mitigation system comprising:

• a first computing system comprising at least a first processor and at least a first non-transitory computer readable storage medium having encoded thereon first instructions that when executed by the at least the first processor cause the first computing system to perform a first process including:
• enabling a first virtual private network internet point of presence (“VPN internet PoP”);
• connecting a plurality of VPN tunnels to an internet via the first VPN internet PoP;
• determining a plurality of technical indicators associated with the plurality of VPN tunnels;
• and
• transmitting the plurality of technical indicators associated with the plurality of VPN tunnels;
• a second computing system comprising at least a second processor and at least a second non-transitory computer readable storage medium having encoded thereon second instructions that when executed by the at least the second processor cause the second computing system to perform a second process including:
• enabling a second virtual private network internet point of presence (“VPN internet PoP”);
• and
• enabling use of the second VPN internet PoP by a plurality of sources comprising a plurality of clients;
• a third computing system in network communication with the first computing system and the second computing system, the third computing system comprising at least a third processor and at least a third non-transitory computer readable storage medium having encoded thereon third instructions that when executed by the at least the third processor cause the third computing system to perform a third process including:
• accessing a first intelligence feed comprising a plurality of cybersecurity incidents, including at least one of threats or attacks, observed on at least one internet-connected computing system and respective indications of from where the plurality of cybersecurity incidents originated;
• receiving from the first computing system the plurality of technical indicators;
• generating a second intelligence feed comprising the plurality of technical indicators;
• comparing the first intelligence feed to the second intelligence feed;
• determining a particular incident of the plurality of cybersecurity incidents based on the comparison of the first intelligence feed to the second intelligence feed;
• determining a time frame of the particular incident based on at least one of the first intelligence feed or the second intelligence feed;
• monitoring the use of the second VPN internet PoP by the plurality of sources comprising the plurality of clients to determine a plurality of time-based behaviors;
• comparing the plurality of time-based behaviors to the particular incident and to the time frame of the particular incident to determine a match of a particular behavior of the plurality of time-based behaviors from a particular source comprising a particular client of the plurality of sources to the particular incident;
• and
• blocking the particular source at the second VPN internet PoP based on the determination of the match of the particular behavior from the particular source to the particular incident.