System and method for proactively enriching a reputation database of bad cyber actors based on similarity scores for bad actors’ behavior profiles

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• receiving attack attributes associated with an attack campaign;
• extracting an attack behavior profile for an identity linked to the attack campaign, wherein the attack behavior profile is based on the received attack attributes;
• retrieving, from a reputation database, behavior profiles of known bad actor groups, wherein bad actor groups are collections of network identities identified for engaging in malicious cyber activity;
• determining similarity scores between the extracted attack behavior profile and the behavior profiles of each known bad actor group;
• and
• enriching the reputation database by updating, based on the determined similarity scores, the extracted attack behavior profile and the behavior profiles of known bad actor groups stored in the reputation database.

A system for detecting botnets, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• receive attack attributes associated with an attack campaign;
• extract an attack behavior profile for an identity linked to the attack campaign, wherein the attack behavior profile is based on the received attack attributes;
• retrieve, from a reputation database, behavior profiles of known bad actor groups, wherein bad actor groups are collections of network identities identified for engaging in malicious cyber activity;
• determine similarity scores between the extracted attack behavior profile and the behavior profiles of each known bad actor group;
• and
• enrich the reputation database by updating, based on the determined similarity scores, the extracted attack behavior profile and the behavior profiles of known bad actor groups stored in the reputation database.