Modification of connections

A computer-implemented method for a cyber threat autonomous response engine configured to control connectivity between a first computing device and a second computing device and take one or more actions to mitigate a cyber threat, comprising:

• determining that a connection between the first computing device and the second computing device needs to be modified;
• identifying an indicator in a message transmitted via the connection in accordance with a communication protocol;
• determining, based on the indicator and knowledge about a previously observed sequence of messages communicated between the first computing device and the second computing device in accordance with the communication protocol, a plurality of triggers to be sent to one or both of the first computing device and the second computing device to modify the connection;
• and
• causing the plurality of triggers to be sent.

An apparatus, comprising:

• a cyber threat autonomous response engine configured to control connectivity between a first computing device and a second computing device and take one or more actions to mitigate a cyber threat, which is further configured to:
• cause information about a sequence of messages communicated between the first computing device and the second computing device to be stored in a cache memory associated with the apparatus, wherein the information comprises a unique indicator associated with each message of the sequence of messages;
• determine that a connection between the first computing device and the second computing device should be interrupted;
• identify a unique indicator associated with a message sent via the connection;
• and
• send, to one or both of the first computing device and the second computing device, a plurality of subsequent messages to interrupt the connection, wherein each subsequent message of the plurality of subsequent messages comprises a unique indicator of a predicted subsequent message, and wherein the predicted subsequent message is based on the identified unique indicator associated with the message and the information about the sequence of messages;
• and
• where instructions implemented in software for the cyber threat autonomous response engine are configured to be stored in one or more non-transitory storage mediums to be executed by one or more processing units.