# US 10,771,497 B1 · Using IP address data to detect malicious activities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,497 B1 - Document ID: US10771497B1 - Status: Granted - Kind: B1 - Application number: 16/188,208 - Filed: 2018-11-12 - Granted: 2020-09-08 - Earliest claimed: 2014-02-11 - Assignees: DataVisor Inc. - Applicants: DataVisor, Inc. - Inventors: Yinglian Xie; Fang Yu - Web page: https://patentgrep.com/patent/US10771497B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting malicious activities. One of the methods includes obtaining a collection of user event logs or receiving user events through real-time feeds; using data from the user event logs/feeds to determine IP address properties for individual IP addresses and IP address ranges; and for each incoming event, updating the IP address properties for the corresponding IP address and IP prefix properties. ## Claims ### Claim 1 A method comprising: obtaining a collection of data associated with a plurality of user events; processing the collection of data to compute a plurality of IP address properties that comprise particular features associated with one or more individual IP addresses and one or more IP address ranges, wherein the IP address properties include a predictable IP address property for a particular user for each IP address the user has used, wherein each predictable IP address property for the particular user corresponds to a calculated probability that the particular user will use a specific IP address or IP address range again based on prior IP address usage; and using the plurality of IP address properties to calculate a probability that events associated with particular IP addresses or IP address ranges are malicious, wherein calculating the probability that events associated with a particular IP address or IP address ranges are malicious includes determining that a group of correlated users all have a predictable IP address property indicating a low likelihood that the user will use to use the corresponding IP address or IP address range again. ### Claim 2 (depends on 1) The method of claim 1, wherein calculating the probability that events associated with a particular IP address are malicious includes determining a distribution of event types within the collection of data for the IP address. ### Claim 3 (depends on 2) The method of claim 2, wherein an uneven distribution of occurrences of particular types of events on the particular IP address increases a probability of maliciousness. ### Claim 4 (depends on 1) The method of claim 1, wherein calculating the probability that events associated with a particular IP address are malicious includes analyzing IP properties for a group of correlated users for distributions of features that do not follow a distribution of the features for an overall population of users. ### Claim 5 (depends on 1) The method of claim 1, wherein determining that the predictable IP address property indicates a low likelihood for a particular IP address results in calculating an increased probability that the IP address is malicious. ### Claim 6 (depends on 1) The method of claim 1, further comprising: comparing IP address properties from different input sources when calculating the probability that events associated with particular IP addresses or IP address ranges are malicious. ### Claim 7 (depends on 1) The method of claim 1, wherein accounts associated with malicious IP addresses are uses as labeled data for a machine learning system configured to detect malicious accounts. ### Claim 8 A system comprising: one or more computers configured to perform operations comprising: obtaining a collection of data associated with a plurality of user events; processing the collection of data to compute a plurality of IP address properties that comprise particular features associated with one or more individual IP addresses and one or more IP address ranges, wherein the IP address properties include a predictable IP address property for a particular user for each IP address the user has used, wherein each predictable IP address property for the particular user corresponds to a calculated probability that the particular user will use a specific IP address or IP address range again based on prior IP address usage; and using the plurality of IP address properties to calculate a probability that events associated with particular IP addresses or IP address ranges are malicious, wherein calculating the probability that events associated with a particular IP address or IP address ranges are malicious includes determining that a group of correlated users all have a predictable IP address property indicating a low likelihood that the user will use to use the corresponding IP address or IP address range again. ### Claim 9 (depends on 8) The system of claim 8, wherein calculating the probability that events associated with a particular IP address are malicious includes determining a distribution of event types within the collection of data for the IP address. ### Claim 10 (depends on 9) The system of claim 9, wherein an uneven distribution of occurrences of particular types of events on the particular IP address increases a probability of maliciousness. ### Claim 11 (depends on 8) The system of claim 8, wherein calculating the probability that events associated with a particular IP address are malicious includes analyzing IP properties for a group of correlated users for distributions of features that do not follow a distribution of the features for an overall population of users. ### Claim 12 (depends on 8) The system of claim 8, wherein determining that the predictable IP address property indicates a low likelihood for a particular IP address results in calculating an increased probability that the IP address is malicious. ### Claim 13 (depends on 8) The system of claim 8, wherein the one or more computers are further configured to perform operations comprising: comparing IP address properties from different input sources when calculating the probability that events associated with particular IP addresses or IP address ranges are malicious. ### Claim 14 (depends on 8) The system of claim 8, wherein accounts associated with malicious IP addresses are uses as labeled data for a machine learning system configured to detect malicious accounts.