Network defense system and framework for detecting and geolocating botnet cyber attacks

A method comprising:

• receiving network traffic data with a centralized data collection and storage subsystem from a plurality of sensors positioned within geographically separately networks;
• providing subsets of the network traffic data from the data collection and storage subsystem to a set of cyber defense algorithms executing on a computing cluster coupled to the data collection storage subsystem, as indicated by a manifest of parameters for the network traffic data to be analyzed by each of the cyber defense algorithms;
• executing the set of cyber defense algorithms to analyze the network traffic data and detect centrally-controlled malware performing a distributed network attack (“botnet attack”) from devices within the geographically separate networks;
• and
• generating a user interface with a visualization and decision-making subsystem to present an electronic map of geographic locations of source devices and target devices of the botnet attacks within the networks.

A computer-readable medium comprising instructions for causing a programmable processor to:

• receive network traffic data from a plurality of sensors positioned within geographically separately networks;
• store the network traffic data to a centralized data collection and storage subsystem;
• execute a set of cyber defense algorithms on a cluster of computing devices coupled to the data collection storage subsystem, wherein the cyber defense algorithms analyze the network traffic data and detect centrally-controlled, malware that is currently performing a distributed network attack (“botnet attack”) from devices within the geographically separate networks;
• and
• generate a user interface with a visualization and decision-making subsystem to present an electronic map of geographic locations of source devices and target devices of the botnet attacks within the networks.

A computing device configured to implement a data collection and storage subsystem, the computing device comprising one or more processors configured to:

• execute a central repository to store network traffic data received from a plurality of sensors positioned within geographically separate networks;
• execute a set of software modules configured to execute a plurality of cyber defense algorithms on a computing cluster coupled to the computing device, wherein the cyber defense algorithms analyze the network traffic data and detect centrally-controlled malware that is configured to perform distributed network attacks (“botnet attacks”) from devices within the geographically separate networks;
• and
• execute a visualization and decision-making subsystem, operatively coupled to the data collection and storage subsystem, that generates a user interface that presents an electronic map of geographic locations of source devices and target devices of the botnet attacks within the networks;
• wherein the data collection and storage subsystem is further configured to store a manifest of parameters for the network traffic data to be analyzed by each of the cyber defense algorithms.