Global clustering of incidents based on malware similarity and online trustfulness

A device comprising:

• a memory unit;
• one or more processors of a computing device configured as a server, configured to perform instructions stored in the memory unit, for creating and storing clusters of incident data records based on behavioral characteristic values in the incident data records and origin characteristic values in the incident data records, wherein execution of the instructions by the processors causes:
• receiving a plurality of input incident data records comprising sets of computer network attribute values determined based upon a plurality of incidents that have occurred in one or more computer networks;
• wherein an incident data record of the plurality of input incident data records comprises at least one or more behavioral characteristic values, a severity level value, and a confidence score value;
• identifying two or more first incident data records that have a particular behavioral characteristic value stored in all of the two or more first incident data records;
• using a malicious incident behavioral data table stored in a data storage device that maps sets of behavioral characteristic values to identifiers of malicious acts in the network, and a plurality of comparison operations using the malicious incident behavioral data table and the two or more first incident data records, determining whether any of the two or more first incident data records has been identified as malicious;
• and
• in response to determining that a first incident data record, from the two or more first incident data records, has been identified as malicious:
• creating and storing in computer memory a similarity behavioral cluster record that includes the two or more first incident data records;
• modifying severity level values that are stored in each of the two or more first incident data records by increasing the severity level values by a first value;
• and
• modifying confidence score values that are stored in each of the two or more first incident data records by increasing the confidence score values by a second value.

A non-transitory computer readable storage medium soring one or more instructions which, when executed by one or more processors, cause the processors to perform:

• receiving a plurality of input incident data records comprising sets of computer network attribute values determined based upon a plurality of incidents that have occurred in one or more computer networks;
• wherein an incident data record of the plurality of input incident data records comprises at least one or more behavioral characteristic values, a severity level value, and a confidence score value;
• identifying two or more first incident data records that have a particular behavioral characteristic value stored in all of the two or more first incident data records;
• using a malicious incident behavioral data table stored in a data storage device that maps sets of behavioral characteristic values to identifiers of malicious acts in the network, and a plurality of comparison operations using the malicious incident behavioral data table and the two or more first incident data records, determining whether any of the two or more first incident data records has been identified as malicious;
• and
• in response to determining that a first incident data record, from the two or more first incident data records, has been identified as malicious:
• creating and storing in a computer memory a similarity behavioral cluster record that includes the two or more first incident data records;
• modifying severity level values that are stored in each of the two or more first incident data records by increasing the severity level values by a first value;
• and
• modifying confidence score values that are stored in each of the two or more first incident data records by increasing the confidence score values by a second value.