Hierarchical Reputation Model for New Internet Entities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for assessing the reputation of Internet entities, such as IP addresses and hostnames, are inadequate as they rely on black- and white-lists and cannot assign a reputation score to new entities, like newly created bots, which are encountered for the first time.
Innovation Solution
A hierarchical modeling processing facility is used to build a reputation model that clusters related systems and assigns a reputation score to new hosts based on statistical measurements of their behavior, allowing for automated assessment and enhanced security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If black- and white-list methods are used to assess reputation, then known entities can be evaluated, but new entities cannot be assigned a reputation score
Solution Approach 1:
The system segments the evaluation process into multiple hierarchical levels (individual entity level, neighborhood level, and regional level). By dividing the reputation assessment into these segments, the system can evaluate new entities at the neighborhood level even when individual entity data is insufficient, thereby resolving the contradiction between reliability and adaptability.
Solution Approach 2:
The system performs preliminary clustering of entities into neighborhoods and pre-calculates neighborhood reputation scores before new entities need to be evaluated. This preliminary action creates a ready-made framework that can immediately assign reputation scores to new entities based on their neighborhood affiliation, enabling rapid adaptation without compromising assessment reliability.
2Ease of operation
If traditional black- and white-lists are used, then simple lookup is possible, but automated clustering and statistical derivation cannot be performed
Solution Approach 1:
The system implements self-service automation where the reputation assessment framework automatically performs entity clustering, neighborhood formation, and statistical reputation derivation without manual intervention. This automated self-service maintains ease of operation for users while enabling complex automated clustering and statistical analysis in the background.
3Measurement precision
If reputation scores are assigned to individual entities only, then precise individual assessment is achieved, but neighborhood-level reputation cannot be derived
Solution Approach 1:
The system merges individual entity reputation data with neighborhood-level statistical analysis. By combining precise individual measurements with aggregated neighborhood data, the system simultaneously achieves high measurement precision for individual entities and comprehensive coverage of multiple entities within each neighborhood, resolving the contradiction between precision and quantity.
Data Source
AI summary
In embodiments of the present invention improved capabilities are described for predicting the reputation of a communication identifier, such as a web address, a domain name, an IP address, host name, email address, IM address, telephone number, VoIP telephony address, and the like. In embodiments, the present invention may receive a communication from a first communication identifier, parse the first communication identifier into its components, and assign the components to a hierarchical tree structure, where the hierarchical tree structure maintains the hierarchical relationship between the components of the communication identifier. The present invention may monitor and keep count of a number of communications from the first communication identifier, wherein the number of communications may be kept for both malicious and/or unwanted communications and non-malicious and/or unwanted communications. Attributes may then be provided to the number of communications for each appropriate component of the hierarchical tree, and a statistical measure may be calculated as related to the number of communications for each component of the hierarchical tree. The present invention may then receive a communication from a second communication identifier, where the second communication identifier may be previously unknown and have a common component with the hierarchical tree. The statistical measure of the common component may then be assigned to the second communication identifier, and utilizing the statistical measure assigned to the second communication identifier, may provide a prediction of reputation of the second communication identifier.