Predictive Blacklist Generation Using Relevance and Maliciousness Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating network address blacklists are ineffective in identifying and incorporating attack sources before they saturate the network, leading to potential damage from prolific attack sources.
Innovation Solution
A method and apparatus for generating highly predictive blacklists by collecting security log data, ranking attack sources based on relevance and maliciousness, and pre-filtering noise to proactively include attack sources in the blacklist, utilizing a relevance ranking scheme and severity metric to prioritize malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blacklist generation methods are used, then existing attack sources can be identified, but prolific attack sources can cause serious damage before being identified and included in the blacklist
Solution Approach 1:
The system performs preliminary actions by predicting future attack sources before they actually attack the network. It uses machine learning models to analyze patterns from historical data and proactively identifies potential attack sources, allowing the blacklist to be updated before the attack occurs, thus preventing the delay problem where attack sources cause damage before being identified.
2Quantity of substance
If security log data from multiple users is collected, then more comprehensive attack detection is achieved, but data processing complexity and noise increase
Solution Approach 1:
The system extracts and separates useful information from the large volume of security log data collected from multiple users. It filters out noise and irrelevant data, then focuses on extracting meaningful attack patterns and features that are relevant for prediction, thereby reducing processing complexity while maintaining comprehensive data coverage.
Solution Approach 2:
The system segments the data processing into distinct stages: data collection from multiple users, data filtering and cleaning, feature extraction, model training, and blacklist generation. This segmentation allows each stage to handle specific aspects of the data independently, reducing overall processing complexity while maintaining comprehensive coverage.
3Measurement precision
If attack sources are ranked based on relevance and maliciousness, then predictive accuracy is improved, but classification and scoring complexity increases
Solution Approach 1:
The system changes parameters by transforming raw security log data into normalized features and scores. It uses machine learning models to convert complex attack patterns into simplified relevance and maliciousness scores, making the classification process more manageable while improving prediction accuracy through sophisticated scoring algorithms.
Data Source
AI summary
In one embodiment, the present invention is a method and apparatus for generating highly predictive blacklists. One embodiment of a method for generating a blacklist of network addresses for a user of a network includes collecting security log data from users of the network, the security log data identifying observed attacks by attack sources, assigning the attack sources to the blacklist based on a combination of the relevance each attack source to the user and the maliciousness of the attack source, and outputting the blacklist.