Security management platforms for assessing threats to an internal network

A computer-implemented method for estimating risk posed by a public communication activity involving an internal Internet Protocol (IP) address that resides on an internal network and an external IP address that does not reside on the internal network, the method comprising:

• acquiring, by a security management platform, probe data from one or more scanning mechanisms deployed on the Internet,
• wherein each scanning mechanism is configured to probe at least one Internet Protocol (IP) address by transmitting a query designed to elicit a response from a certain service, and
• wherein the probe data includes a first response provided by the internal IP address and a second response provided by the external IP address;
• evaluating, by the security management platform, a risk posed by the public communication activity based on the probe data;
• determining, by the security management platform, that the risk exceeds a certain threshold;
• and
• transmitting, by the security management platform, an instruction to a firewall deployed on a perimeter of the internal network,
• wherein the instruction instructs the firewall to prevent a future breach of the internal network by deflecting an incoming communication from the external IP address to a honeypot server.

A system comprising:

• one or more scanning mechanisms deployed on the Internet,
• wherein each scanning mechanism is configured to
• probe at least one Internet Protocol (IP) address by transmitting a query designed to elicit a response, and
• create probe data from any responses received from the at least one IP address;
• and
• a security management platform configured to
• acquire local netflow that includes all traffic that crossed a perimeter of an internal network during a certain time interval,
• examine the local netflow to detect a public communication activity involving an internal IP address that resides on the internal network and an external IP address that does not reside on the internal network,
• determine that a risk posed by the public communication activity exceeds a certain threshold, and
• notify a firewall deployed along a perimeter of the internal network that future communications received from the external IP address should be deflected to a honeypot server.