Skewness in indicators of compromise

A skewness analyzer, comprising:

• a hardware platform;
• and
• a skewness analysis engine to execute on the hardware platform, and configured to:
• receive historical prevalences for an indicator of compromise (IoC) across a plurality of sectors;
• receive observed prevalences for the IoC across the sectors;
• calculate a composite goodness-of-fit between the historical prevalences and observed prevalences to provide a first p-value;
• from the observed prevalences, calculate a two-proportions statistic between a highest prevalence sector and a next-highest-prevalence sector to provide a second p-value;
• compute a two-proportions statistic between the observed prevalence and an expected prevalence, based on the historical prevalences, for the highest prevalence sector to provide a third p-value;
• select a final p-value being the least significant of the three provided p-values;
• query a subscriber database for a subscriber identifier and notification criterion;
• and
• if the final p-value meets the notification criterion, notify a subscriber of a security event associated with the final p-value.

One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to:

• query a database for historical prevalences for a plurality of sectors and an indicator of compromise (IoC);
• receive updated prevalences for the plurality of sectors and the IoC;
• compute expected prevalences for the plurality of sectors and the IoC;
• compute a plurality of statistical p-values from the historical prevalences, the updated prevalences, and the expected prevalences, the plurality of statistical p-values including at least a goodness-of-fit and a two-proportions test;
• select a largest magnitude p-value from the plurality of statistical p-values;
• and
• perform a network security action according to the largest magnitude p-value.