System and method for assessing whether a communication contains an attack

A method for assessing whether communications contain attacks, the method comprising:

• determining, by an attack detection device, a plurality of hierarchical parameters of communications ascertainable from destination addresses;
• applying a plurality of countermeasures to communications to produce countermeasures test results, each characterizing a probability and a confidence of an attack;
• maintaining a database containing profiles of communications containing attacks on diverse entities, wherein each profile comprises the plurality of hierarchical parameters and the countermeasures test results for a communication deemed to have contained an attack;
• selecting a combination of the countermeasures test results for assessing whether a current communication contains an attack based on a profile identified by referencing the plurality of hierarchical parameters of the current communication to the database;
• computing a first probability and a first confidence of the current communication based on the selected combination of the countermeasures test results;
• and
• automatically updating the database with a profile of the current communication in response to determining that the first probability and the first confidence exceed a threshold.

A method for assessing whether a communication contains an attack, the method comprising:

• maintaining, by an attack detection device, a database comprising attack profiles aggregated from remote network sites, the attack profiles characterizing attacks according to a plurality of hierarchical parameters and according to results of a plurality of countermeasure assessments, wherein the maintaining comprises maintaining attack profiles that characterize attacks according to industry, client, site, device, and results of a plurality of countermeasure assessments, and the plurality of countermeasure assessments comprises a signature countermeasure, a reputation countermeasure, a behavior countermeasure, and a pattern countermeasure;
• receiving the communication;
• associating the plurality of hierarchical parameters with the communication;
• applying the plurality of countermeasure assessments to the communication, each countermeasure assessment producing a respective probability that the communication contains an attack and a respective confidence score for the respective probability;
• producing a composite probability that the communication contains an attack and a composite confidence score for the composite probability in response to processing each of the respective probabilities and each of the respective confidence scores that weights each of the respective probabilities by referencing the plurality of hierarchical parameters of the communication to one or more of the attack profiles in the database;
• determining that the communication contains a new attack based on the composite probability and the composite confidence score;
• and
• updating the database to include a new attack profile associated with the new attack.