Overlapping IP Range Lookup Using Positional Scores and Tags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for searching and determining membership of an IP address in threat lists with overlapping IP address ranges are inefficient and time-consuming, especially as the number of IP addresses and overlaps increase, necessitating improved solutions for quick and efficient identification of malicious IP addresses.
Innovation Solution
A system that stores and queries overlapping IP address ranges using positional scores and tag identifiers, allowing for constant O(1) access time, irrespective of the number of overlapping groups, through the use of a positional table, tag storage set, and an out-of-band process for managing and cleaning IP address data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional searching methods (manual searching or interval trees) are used to determine IP address membership in threat lists, then the system can handle overlapping IP address ranges, but the complexity and search time increase as the number of IP addresses and overlaps grow
Solution Approach 1:
The patent segments the IP address space by converting IP addresses into positional scores, which divide the continuous IP address range into discrete, manageable segments. This segmentation allows the system to handle overlapping ranges efficiently by working with discrete positional values rather than continuous ranges, directly resolving the technical contradiction between search speed and system complexity.
2Reliability
If the number of IP address ranges in threat lists increases to cover more malicious addresses, then the coverage and detection capability improve, but the time to search and locate an IP address increases
Solution Approach 1:
The patent replaces the mechanical linear searching process with a mathematical transformation system. IP addresses are converted to positional scores through a deterministic mathematical function, allowing constant-time O(1) lookup instead of linear or logarithmic search. This substitution maintains high detection accuracy while eliminating the time penalty associated with larger datasets.
3Adaptability or versatility
If data sources are constantly changing and growing with new IP address ranges added, then the threat intelligence coverage improves, but the complexity to manage and search the expanding data set increases
Solution Approach 1:
The patent changes the parameter representation of IP addresses from their traditional dotted-decimal format to positional scores. This parameter transformation allows new IP address ranges to be integrated by simply adding new positional score entries to the data structure, without increasing the complexity of the search algorithm or data management processes.
Data Source
AI summary
The described systems and techniques provide improved storage for overlapping IP address ranges and improved access to a given IP address's membership in the stored overlapping IP address ranges, in constant, O(1) access time with respect to the number of IP ranges stored or number of overlaps. The systems and technique include receiving an IP address, generating a positional score for the IP address, querying a positional data set containing a plurality of positional values using the positional score to find a first matching positional value, and querying a tag storage set containing a plurality of tag identifiers (IDs) using the first matching positional value to find a tag identifier (ID) from the plurality of tag IDs matching the first matching positional value, where the tag ID contains one or more tags with each of the one or more tags identifying a range of IP addresses containing the IP address.