Populated IP Address Classification via Service Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying and classifying Populated IP (PIP) addresses, which are associated with a large number of users or user requests, is challenging due to their dynamic nature, coexistence with good addresses, and lack of publicly available network usage information, making it difficult for online service providers to ensure security.
Innovation Solution
A service log analysis is performed to determine good and bad PIP addresses by leveraging existing information on legitimate and malicious accounts, with features used to train a classifier that identifies and labels these addresses, providing security services to service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service providers use IP addresses to perform blacklisting and service throttling, then security against attacks is improved, but effectiveness is reduced for IP addresses associated with a large number of users
Solution Approach 1:
The patent segments IP addresses into different categories based on their usage patterns. It identifies Populated IP (PIP) addresses that serve multiple users and separates them from traditional single-user IP addresses. This segmentation allows the system to apply different security policies and classification methods to different IP types, improving overall security effectiveness while avoiding misclassification of legitimate multi-user IPs
Solution Approach 2:
The patent implements dynamic classification of IP addresses based on real-time service log analysis. Instead of static blacklisting, the system continuously monitors IP address usage patterns, account associations, and service requests to dynamically determine whether an IP is good or bad. This dynamic approach allows the system to adapt to changing threats while maintaining accuracy for IPs with large user populations
2Measurement precision
If service providers analyze service logs to identify PIP addresses, then classification accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent performs preliminary analysis of service logs to pre-identify PIP addresses and their associated characteristics before actual security classification is needed. By pre-processing the service logs and extracting relevant features (number of associated accounts, usage patterns, temporal distributions), the system reduces the computational burden during real-time security operations while maintaining high classification accuracy
3Reliability
If service providers leverage existing account information to determine good and bad PIP addresses, then classification reliability is improved, but data privacy concerns increase
Solution Approach 1:
The patent extracts only the necessary features from service logs and account information that are needed for PIP address classification, rather than processing or storing complete account data. It extracts features such as the number of accounts associated with an IP, usage patterns, and temporal distributions, while leaving the actual account information and detailed network usage data confidential. This extraction approach maintains classification reliability while preserving data privacy
Data Source
AI summary
A service log of a service provider is analyzed to identify IP addresses used by account holders that are populated IP addresses. Existing information about legitimate and malicious accounts of the service provider is leveraged to determine likely good and bad populated IP addresses based on the accounts that use the populated IP addresses. Features of the good and bad populated IP addresses are used to train a classifier that can identify good and bad populated IP addresses based on features of the populated IP addresses. The classifier may be used to provide security services to the same service provider or different service providers. The services include identifying malicious accounts.