Discovering internet protocol (ip) addresses involved in flows traversing the internet

A non-transitory computer-readable medium with instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

• acquiring, by a security management platform, multiple unclassified data streams from at least two different sources,
• wherein each unclassified data stream of the multiple unclassified data streams includes information regarding traffic that traversed a perimeter of an internal network associated with an organization;
• fusing, by the security management platform, the multiple unclassified data streams together to form a unified workflow;
• identifying, by the security management platform, a vector of attack against a cyber asset residing on the internal network by examining the unified workflow;
• and
• causing a remediation action to be performed to deny the vector of attack.

An electronic device comprising:

• a memory that includes instructions for discovering internal Internet Protocol (IP) addresses that communicate with external IP addresses via the Internet,
• wherein the instructions, when executed by a processor, cause the processor to:
• acquire global netflow that includes all traffic having a certain characteristic that traversed the Internet during a certain time interval;
• filter the global netflow to obtain local netflow corresponding to an internal network on which the internal IP addresses resided during at least a portion of the certain time interval,
• wherein the local netflow includes all traffic having the certain characteristic that crossed a perimeter of the internal network during the certain time interval;
• parse the local netflow to identify each internal IP address that was involved in a public communication activity during the certain time interval;
• create a first list that includes all internal IP addresses that were involved in public communication activities during the certain time interval;
• compare the first list to a second list that includes all internal IP addresses that are presently being monitored;
• and
• determine a risk posed by the public communication activities.