IP Mass Host Verification for Accurate Domain Reputation Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyberthreat protection systems incorrectly block or safelist entire IP mass hosts based on the reputation of a single domain, leading to false positives or negatives, as they lack the ability to distinguish between good and bad domains hosted by the same IP address.
Innovation Solution
Implement automated methods to identify IP mass hosts by analyzing DNS records and WHOIS data to determine the number of unique registrants and the percentage of bad domains, classifying IP addresses as good or bad based on domain reputation, and updating reputation lists accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP addresses are blocked based on bad domain reputation, then bad domains are protected from phishing attacks, but good domains hosted by the same IP address are incorrectly blocked (false positives)
Solution Approach 1:
The patent segments the IP address evaluation into two distinct categories: IP mass hosts (hosting multiple domains from different registrants) and non-mass hosts (hosting single or few domains). This segmentation allows different evaluation criteria to be applied to each type, preventing false positives by not blocking IP addresses solely based on one bad domain when multiple good domains are also hosted there.
Solution Approach 2:
The patent applies different quality standards to different parts of the IP address ecosystem. For IP mass hosts, it evaluates the overall composition of hosted domains (requiring majority good domains), while for non-mass hosts, it applies stricter blocking criteria. This local differentiation ensures that good domains are not incorrectly blocked while still protecting against bad domains.
2Object-affected harmful factors
If IP mass hosts with multiple domains are blocked based on single bad domain, then bad domains are blocked, but legitimate good domains are also blocked (false negatives)
Solution Approach 1:
The patent divides IP addresses into mass hosts and non-mass hosts, applying different evaluation thresholds to each. For IP mass hosts, it requires that bad domains constitute a majority before blocking, thereby avoiding false negatives where good domains are incorrectly blocked due to association with a single bad domain.
Solution Approach 2:
The patent changes the blocking parameter from binary (block or don't block) to a threshold-based evaluation. For IP mass hosts, it uses a parameter change where blocking occurs only when bad domains exceed a certain proportion (e.g., majority), allowing flexibility in decision-making based on the overall composition of hosted domains.
3Productivity
If automated reputation list updating is implemented, then response time to bad domains is reduced, but false positives and negatives increase due to lack of IP mass host analysis
Solution Approach 1:
The patent performs preliminary analysis of IP address characteristics (determining whether an IP is a mass host by checking the number of unique registrants) before final reputation decisions are made. This preliminary action enables more accurate classification while maintaining automated processing speeds, as the mass host determination is performed in advance of the final blocking decision.
Solution Approach 2:
The patent incorporates feedback mechanisms where the analysis of IP mass host characteristics continuously refines reputation list updates. By feeding back the information about domain composition and registrant diversity, the system improves its accuracy over time while maintaining automated operation, reducing both false positives and negatives through iterative refinement.
Data Source
AI summary
Systems, methods, and products for identifying IP mass hosts and determining whether they are good or bad. One embodiment is a method including selecting a first candidate IP address, identifying a set of domains hosted at the IP address, and identifying registrants of the domains. A number of unique ones of the registrants is determined and if the number of unique registrants exceeds a threshold number, the candidate IP address is deemed an IP mass host. Otherwise, the candidate IP address is deemed not to be an IP mass host. For an IP mass host, domains that have bad reputations are identified, and it is determined whether the bad domains comprise at least a threshold percentage of the total hosted domains. If the IP mass host has at least the threshold percentage of bad domains, the IP mass host is deemed a bad mass host.