IP Address Maliciousness Classification via Subnet Mask Matrix
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in identifying and classifying potentially malicious IP addresses due to their dynamic nature and the difficulty in maintaining block-lists, especially with the increased IP space from IPv4 to IPv6, which leads to inefficient defense against malicious internet communications.
Innovation Solution
The use of machine learning models to represent IP addresses in a representational space by applying different subnet masks to create a matrix, which is then input into a convolutional neural network (CNN) to determine the maliciousness score, incorporating additional characteristics like ISP information to improve classification accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional block-lists are used to identify malicious IP addresses, then implementation is simple, but accuracy and adaptability deteriorate due to dynamic nature of malicious infrastructure and expanded IPv6 address space
Solution Approach 1:
The patent replaces traditional mechanical block-list maintenance with a machine learning-based automated classification system. The ML model automatically learns patterns from network traffic data and infrastructure characteristics, substituting manual block-list updates with intelligent automated detection that adapts to changing threats without requiring manual intervention.
Solution Approach 2:
The patent transforms IP address representation from simple binary/decimal formats to matrix representations that incorporate multiple parameters including subnet masks, ISP information, and network characteristics. This parameter transformation enables the ML model to capture complex relationships and improve identification accuracy while maintaining computational efficiency.
2Quantity of substance
If IPv6 address space is adopted to expand IP capacity, then address availability improves, but difficulty of detecting and measuring malicious infrastructure increases due to larger address space
Solution Approach 1:
The patent segments the vast IPv6 address space into meaningful groups using subnet masks and network hierarchy. By applying different subnet masks to create matrix representations, the system organizes the enormous IPv6 space into manageable segments that can be efficiently analyzed by ML models, reducing the complexity of detecting malicious addresses in the expanded space.
Solution Approach 2:
The patent introduces matrix representations as an intermediary layer between raw IP addresses and ML model analysis. This intermediary transformation converts IPv6 addresses into structured matrices that incorporate network hierarchy and ISP information, making the large address space more tractable for detection while preserving the ability to identify malicious patterns.
3Measurement precision
If machine learning models with matrix representations are used to classify malicious IP addresses, then identification accuracy improves, but device complexity increases
Solution Approach 1:
The patent creates a universal matrix representation framework that handles both IPv4 and IPv6 addresses through the same ML model architecture. The system processes different IP versions, network types, and ISP information through a unified approach, reducing overall system complexity despite the sophistication of individual components.
Solution Approach 2:
The patent uses matrix representations as simplified copies of the complex IP address structure. Instead of directly analyzing raw IP addresses with all their complexity, the system creates matrix copies that capture essential characteristics (subnet information, ISP data, network hierarchy) in a standardized format that ML models can efficiently process.
Data Source
AI summary
Embodiments disclosed include methods and apparatus for detecting a reputation of infrastructure associated with potentially malicious content. In some embodiments, an apparatus includes a memory and a processor. The processor is configured to identify an Internet Protocol (IP) address associated with potentially malicious content and define each row of a matrix by applying a different subnet mask from a plurality of subnet masks to a binary representation of the IP address to define that row of the matrix. The processor is further configured to provide the matrix as an input to a machine learning model, and receive, from the machine learning model, a score associated with a maliciousness of the IP address.