Determining risk associated with internet protocol (ip) addresses involved in internet communications

A computer-implemented method for estimating risk posed by a public communication activity involving an internal Internet Protocol (IP) address that resides on an internal network associated with an organization, the method comprising:

• examining local netflow to detect a public communication activity involving an internal IP address that resides on the internal network and an external IP address that does not reside on the internal network;
• probing the external IP address by transmitting a query designed to elicit a response from a particular service;
• receiving the response from the external IP address;
• in response to receiving the response,
• determining that the particular service is presently running on the external IP address;
• and
• evaluating a risk posed by the public communication activity to the internal activity due to the presence of the particular service on the external IP address.

A computer-implemented method for estimating risk posed by a public communication activity involving an internal Internet Protocol (IP) address that resides on an internal network associated with an organization, the method comprising:

• examining local netflow to detect a public communication activity involving an internal IP address that resides on the internal network and an external IP address that does not reside on the internal network;
• probing the internal IP address by transmitting a query designed to elicit a response;
• receiving the response from the internal IP address;
• and
• evaluating a risk posed by the public communication activity to the internal network by analyzing the response to detect whether any services determined to be vulnerable to unauthorized access are running on the internal IP address.

A computer-implemented method for estimating risk posed by public communication activities involving one or more internal Internet Protocol (IP) addresses that reside on an internal network associated with an organization, the method comprising:

• acquiring local netflow that includes all traffic that crossed a perimeter of the internal network over a first time interval;
• examining historical local netflow that includes all traffic that crossed the perimeter of the internal network over a second time interval;
• generating a threshold based at least in part on the historical local netflow;
• and
• evaluating a risk posed by public communication activities in the first time interval to the local network by comparing the local netflow to the threshold.

A computer-implemented method for estimating risk posed by a public communication activity involving an internal Internet Protocol (IP) address that resides on an internal network managed by an organization, the method comprising:

• acquiring local netflow that includes all traffic that crossed a perimeter of the internal network over a certain time interval;
• examining the local netflow to detect a public communication activity involving an internal IP address that resides on the internal network and an external IP address that does not reside on the internal network;
• comparing the external IP address to a source list that includes one or more external IP addresses known to be associated with an increased security risk;
• and
• evaluating, based on said comparing, a risk posed by the public communication activity to the internal network.