System and method for restricting pathways to harmful hosts in computer networks

A system for detecting malicious activity in a computer network that includes hosts and connectors between the hosts, the system comprising:

• computing hardware including at least one processor, non-transitory data storage interfaced with the at least one processor, and input/output facilities including network interfacing facilities, the data storage containing instructions that, when executed, establish:
• a controllable execution environment module implemented in the computing hardware according to the instructions to explore network pathways to a plurality of investigated hosts, wherein the network pathways to each of the plurality of investigated hosts are explored by the computing hardware from a first entry point to the computer network and a second entry point to the computer network, the second entry point being varied from the first entry point;
• and
• a graphing module implemented in the computing hardware according to the instructions to form a graph data structure based on results of the exploring of the network pathways, the graph data structure representing topology of explored portions of the computer network, including connectors between the investigated hosts and intermediary hosts situated along explored pathways that include the investigated hosts, and an indication of a prevalence of connectors in pathways to each of the investigated hosts;
• a connector evaluator module implemented in the computing hardware according to the instructions to compare the prevalence of connectors along pathways to each of the investigated hosts against a prevalence threshold, and to identify, among the hosts situated along pathways to a common investigated host, any suspicious host that is associated with a connector having a low prevalence that is below the prevalence threshold, wherein the prevalence threshold comprises an intensity of use for the connector to transmit information to and from a particular host to determine the connector role in accessing malicious content, wherein the connector evaluator module is further configured to obtain registration information for all of the plurality of investigated hosts, determine whether the registration information for a particular investigated host matches an address in a malicious host database, and add the address for the particular investigated host matching the registration information to the malicious host database;
• and
• a security response module implemented in the computing hardware according to the instructions to associate an access restriction with the suspicious host and at least one intermediate host situated between the common investigated host and the connector and associated with the connector having a low prevalence, wherein each of the investigated hosts is a trusted host, and wherein the access restriction is applied to the at least one intermediate host that corresponds to a connector having a prevalence that is less than the prevalence value the connector used in a previous attempt to transfer data to and from the investigated host,
• wherein the connector evaluator module is further configured to add the suspicious host and the at least one intermediate host situated between the common investigated host and the connector and associated with the connector having a low prevalence to the malicious host database.

An automated computer-implemented system for detecting malicious activity in a computer network that includes hosts and connectors between the hosts, the system comprising:

• means for exploring network pathways to a plurality of investigated hosts, wherein the network pathways to each of the plurality of investigated hosts are explored by the means for exploring network pathways from a first entry point to the computer network and a second entry point to the computer network, the second entry point being varied from the first entry point;
• means for forming a graph data structure based on results of the exploring of the network pathways, the graph data structure representing topology of explored portions of the computer network, including connectors between the investigated hosts and intermediary hosts situated along explored pathways that include the investigated hosts, and an indication of a prevalence of connectors in pathways to each of the investigated hosts;
• means for obtaining registration information for all of the plurality of investigated hosts;
• means for determining whether the registration information for a particular investigated host matches an address in a malicious host database;
• means for adding the address for the particular investigated host matching the registration information to the malicious host database;
• means for comparing the prevalence of connectors along pathways to each of the investigated hosts against a prevalence threshold;
• means for identifying, among the hosts situated along pathways to a common investigated host, any suspicious host that is associated with a connector having a low prevalence that is below the prevalence threshold, wherein the prevalence threshold comprises an intensity of use for the connector to transmit information to and from a particular host to determine the connector role in accessing malicious content;
• means for associating an access restriction with the suspicious host and at least one intermediate host situated between the common investigated host and the connector and associated with the connector having a low prevalence, wherein each of the investigated hosts is a trusted host, and wherein the access restriction is applied to the at least one intermediate host that corresponds to a connector having a prevalence that is less than the prevalence value the connector used in a previous attempt to transfer data to and from the investigated host;
• and
• means for adding the suspicious host and the at least one intermediate host situated between the common investigated host and the connector and associated with the connector having a low prevalence to the malicious host database.