AWS unveils Mithra to identify and mitigate malicious domains across its massive system

Amazon disclosed “Mithra,” an internal, AI/ML-driven security platform built on a massive graph database (3.5B nodes, 48B edges) to detect and block malicious domains at Amazon scale, integrating with services like WAF, GuardDuty, and the Sonaris observation platform. Handling up to 200 trillion DNS requests per AWS Region and detecting an average of 182,000 new malicious domains daily, Mithra funnels vast telemetry to high-confidence decisions, automating blocks when appropriate and assisting analysts via generative AI for faster, natural-language threat exploration; the company also emphasizes collaboration through its CISO network for rapid response.