Information networks are threatened on a daily basis with attacks from malicious computers or software, such as botnets (collections of computers controlled by a central actor, used for malicious purposes), computer viruses, worms, trojan horses, spyware, adware, phishing URLs or emails (URLs or emails designed to fool users into revealing private information), and rootkits. This software is often referred to collectively as “malware.” To combat the threats posed to information networks by malware, the administrators of these networks need information about potential and actual threats, including information identifying sources of malware, such as suspicious websites, domains, IP addresses, URLs, e-mail addresses, and files.
There are a number of providers of threat information, both open source and paid/closed source. These providers supply intelligence feeds, which provide information about threats the provider has identified. Most network administrators subscribe to both open source and paid/closed source threat and intelligence feeds to keep up with current malware activity. However, each of these feeds comes in a proprietary format, and depending upon the strength of the research and development unit behind them, also comes with widely variant degrees of validation and reliability. As a result, it is difficult for network administrators to aggregate these disparate intelligence feeds into a format that is useable with their organizations. This results in the intelligence feed data going un- or under-utilized. Thus there is a need for a single normalized, validated threat feed that aggregates threat information from many sources, and that can be immediately put to use defending information networks, in real-time, against current malware threats.