Finding command and control center computers by communication link tracking

A system comprising:

• one or more computers;
• and
• a non-transitory storage device storing instructions operable to cause the one or more computers to perform operations comprising:
• determining a communication link profile for each of a plurality of internal computers that are within a network and have collectively communicated with a plurality of external computers that are outside of the network, the communication link profile for each internal computer comprising a representation of a set of external computers that have communicated with the internal computer;
• grouping the internal computers into computer clusters based on similarities in communication link profiles for each internal computer, wherein internal computers having communication link profiles that reach a threshold level of similarity are grouped into a same cluster;
• accessing a computer memory storing a list of previously identified command and control center computers;
• determining that a particular external computer of the plurality of external computers is identified as a command and control center computer by the list of previously identified command and control center computers;
• identifying a particular internal computer that has previously communicated with the particular external computer;
• identifying a particular computer cluster that includes the particular internal computer;
• determining a set of external computers that have communicated with one or more internal computers in the particular computer cluster;
• and
• designating each of the computers in the set of external computers that have communicated with one or more internal computers in the particular computer cluster as being possible a command and control center computer for further investigation.

A computer-implemented method to be performed by one or more processors of a computing system, the method comprising:

• determining a communication link profile for each of a plurality of external computers that are outside of a network and that are in communication with a plurality of internal computers that are within the network, the communication link profile for each external computer comprising a representation of a set of the internal computers that have communicated with the external computer;
• grouping the external computers into computer clusters based on similarities in communication link profiles for each external computer, wherein external computers having communication link profiles that reach a threshold level of similarity are grouped into a same cluster;
• accessing a computer memory storing a list of previously identified command and control center computers;
• determining that a particular external computer of the plurality of external computers is identified as a command and control center computer by the list of previously identified command and control center computers;
• identifying a particular computer cluster that includes the particular external computer;
• designating each of the external computers in the particular computer cluster as being a possible command and control center computer for further investigation.