System, apparatus, and method for protecting a network using internet protocol reputation information

A method for protecting a plurality of guarded networks from Internet threats, each guarded network of the plurality of guarded networks comprising at least one firewall, the method comprising:

• receiving traffic information via the Internet from each log collection circuit of a plurality of log collection circuits, each log collection circuit of the plurality of log collection circuits in operative communication with one or more firewalls of a corresponding guarded network of the plurality of guarded networks and comprising at least one memory device operative to store the traffic information of the corresponding guarded network, the traffic information comprising information regarding memory usage of the at least one memory device and information regarding outbound or incoming communications blocked by the one or more firewalls;
• receiving intelligence data from a plurality of intelligence sources via the Internet, the intelligence data indicative of information regarding a plurality of addresses;
• generating reputation information regarding one or more addresses of the plurality of addresses, the reputation information generated in response at least to the received traffic information and at least to the received intelligence data, the reputation information indicative of a likelihood for each address that the address is a threatening source address;
• and
• transmitting the reputation information to each log collection circuit of the plurality of log collection circuits.

A log collection circuit for protecting a guarded network of a plurality of guarded networks from Internet threats, the guarded network comprising at least one firewall, the circuit comprising:

• at least one processor in operative communication with a computer system via the Internet and in operative communication with the at least one firewall of the guarded network, the at least one processor operative to:
• receive information from the at least one firewall indicative of inbound communications received by the corresponding guarded network from the Internet and outbound communications transmitted by the corresponding guarded network to the Internet;
• generate inbound and outbound traffic information of the guarded network in response to the information received from the at least one firewall;
• transmit the traffic information to the computer system;
• receive reputation information from the computer system, the reputation information regarding one or more addresses of a plurality of addresses, the reputation information indicative of a likelihood for each address that the address is a threatening source address;
• generate control information in response at least to the received reputation information;
• and
• transmit the control information to the at least one firewall;
• and
• at least one memory device in operative communication with the at least one processor, the at least one memory device operative to store the traffic information and the received reputation information, the traffic information comprising information regarding memory usage of the at least one memory device and information regarding outbound or incoming communications blocked by the at least one firewall.