IP Reputation Scoring With Weighted Multi-Source Threat Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional IP address blacklists and whitelists contain many false positives and inaccurately classify legitimate IP addresses as threats, necessitating a more reliable method to assess threat potential and trusted affiliation.
Innovation Solution
An IP reputation system that generates threat and usage scores based on data from multiple sources, considering factors like membership in blacklists/whitelists, recency of events, quantity of events, and event severity, with weighted scoring to account for data source accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP address blacklists and whitelists are used to classify IP addresses as threats, then network security filtering is provided, but false positives occur and legitimate IP addresses are mistakenly classified as threats
Solution Approach 1:
The patent segments the traditional binary classification system into multiple independent scoring dimensions: threat reputation score, usage score, and multiple data source weights. Each dimension evaluates specific aspects of IP address behavior separately, allowing for nuanced assessment rather than simple black/white classification. This segmentation enables the system to identify and weigh different types of evidence independently, reducing false positives by considering multiple factors simultaneously.
Solution Approach 2:
The patent transforms the classification approach from static binary categories to dynamic multi-parameter scoring. Instead of fixed blacklist/whitelist membership, the system calculates continuous scores based on multiple variables: recency of events, quantity of events, severity weights, and data source reliability. This parameter-based approach allows legitimate IPs to be distinguished from threats by analyzing patterns across multiple dimensions rather than relying on single-criteria classification.
2Reliability
If multiple data sources are used to generate threat scores, then reliability of threat assessment is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service through automated weight calculation and score aggregation. The system automatically determines the reliability weight of each data source based on historical accuracy, then uses these weights to compute final threat and usage scores without manual intervention. The weighted sum algorithm automatically combines multiple data sources, with more reliable sources contributing more to the final score. This automation handles the complexity of multi-source integration while maintaining reliability through consistent, rule-based processing.
3Ease of manufacture
If traditional blacklist methods are used, then implementation is simple, but false positives and inaccurate classification occur
Solution Approach 1:
The patent incorporates feedback mechanisms where the system continuously monitors and evaluates the accuracy of each data source. Based on this feedback, the system automatically adjusts the weight assigned to each data source, giving more influence to historically accurate sources and less to unreliable ones. This feedback loop maintains reliability by adapting to changing data quality while preserving ease of implementation through automated adjustments rather than manual configuration.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.