System and method for detection of targeted attacks

A system for detection of targeted attacks from a network resource, comprising:

• a hardware processor configured to execute a plurality of software modules, including:
• a resource verification module configured to receive from a plurality of computer systems data about the network resource, wherein each of the plurality of computer systems has a set of parameters and associated parameter values;
• an anomaly detection module configured to:
• detect presence of a suspect indicator in the respective data received from each of a first group of the plurality of computer systems;
• and
• detect absence of the suspect indicator in the respective data received from each of a second group of the plurality of computer systems;
• and
• a targeted attack detection module configured to:
• determine at least one suspect parameter and at least one suspect parameter value such that:
• the at least one suspect parameter is set to the at least one suspect parameter value in each of the first group of the plurality of computer systems, and
• the at least one suspect parameter is not set to the at least one suspect parameter value in each of the second group of the plurality of computer systems;
• and
• estimate a probability of the targeted attack from the network resource based on the suspect indicator, the at least one suspect parameter, and the at least one parameter value.

A computer program product stored on a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for detection of targeted attacks from a network resource, comprising instructions for:

• receiving from a plurality of computer systems data about the network resource, wherein each of the plurality of computer systems has a set of parameters and associated parameter values;
• detecting presence of a suspect indicator in the respective data received from each of a first group of the plurality of computer systems;
• detecting absence of the suspect indicator in the respective data received from each of a second group of the plurality of computer systems;
• determining at least one suspect parameter and at least one suspect parameter value such that:
• the at least one suspect parameter is set to the at least one suspect parameter value in each of the first group of the plurality of computer systems, and
• the at least one suspect parameter is not set to the at least one suspect parameter value in each of the second group of the plurality of computer systems;
• and
• estimating a probability of the targeted attack from the network resource based on the suspect indicator, the at least one suspect parameter, and the at least one parameter value.