Systems and methods for classifying security events as targeted attacks

A system for classifying malicious security events as targeted attacks, the system comprising:

• a detection module, stored in memory, that detects a malicious security event in connection with at least one organization;
• a determination module, stored in memory, that:
• compares the malicious security event against a targeted-attack taxonomy that comprises a plurality of categories, each category including a plurality of characteristics of targeted attacks;
• determines, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, that the malicious security event is likely specifically targeting the organization by:
• calculating, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, a category score for each category within the plurality of categories included in the targeted-attack taxonomy;
• determining the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy;
• calculating, based at least in part on each category score and the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy, a taxonomy score that represents the likelihood that the malicious security event is part of a targeted attack campaign as opposed to an indiscriminate or non-targeted attack;
• determining that the taxonomy score exceeds a certain threshold;
• and
• a classification module, stored in memory, that classifies the malicious security event as part of a targeted attack campaign that is specifically targeting the organization instead of an indiscriminate or non-targeted attack in response to the determination that the malicious security event is likely specifically targeting the organization;
• and
• at least one hardware processor that executes the detection module, the determination module, and the classification module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• detect a malicious security event in connection with at least one organization;
• compare the malicious security event against a targeted-attack taxonomy that comprises a plurality of categories, each category including a plurality of characteristics of targeted attacks;
• determine, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, that the malicious security event is likely specifically targeting the organization by:
• calculating, based at least in part on comparing the malicious security event against the targeted-attack taxonomy, a category score for each category within the plurality of categories included in the targeted-attack taxonomy;
• determining the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy;
• calculating, based at least in part on each category score and the number of features of the malicious security event that match corresponding characteristics identified in the targeted-attack taxonomy, a taxonomy score that represents the likelihood that the malicious security event is part of a targeted attack campaign as opposed to an indiscriminate or non-targeted attack;
• and
• determining that the taxonomy score exceeds a certain threshold;
• and
• in response to determining that the malicious security event is likely specifically targeting the organization, classify the malicious security event as part of a targeted attack campaign that is specifically targeting the organization instead of an indiscriminate or non-targeted attack.