Intrusion detection system for automated determination of IP addresses

An intrusion detection system, comprising:

• an index tree, wherein the index tree is configured to store one or more IP addresses and associated information in one or more nodes of the index tree in a predefined sorting order, wherein each node of the one or more nodes is assigned a predefined maximum size;
• a processor;
• wherein the processor is configured to perform a method, the method comprising:
• receiving, by an intrusion detection system, an index tree, wherein the index tree is configured to store one or more IP addresses and associated information in one or more nodes of the index tree in a predefined sorting order, wherein each node of the one or more nodes is assigned a predefined maximum size;
• receiving, by the intrusion detection system, structured data including a first set of one or more IP addresses from a honeypot system;
• receiving, by the intrusion detection system, unstructured data indicative of a second set of one or more IP addresses from a predefined data source;
• processing, by the intrusion detection system, the unstructured data to identify the second set of one or more IP addresses;
• and
• storing, by the intrusion detection system, the first set of one or more IP addresses and the second set of one or more IP addresses in the index tree according to the predefined maximum size for the one or more nodes, wherein each node of the one or more nodes includes a corresponding IP address level for each IP address of the first set of the one or more IP addresses and the second set of one or more IP addresses.

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by an intrusion detection system to cause the intrusion detection system to perform a method comprising:

• receiving, by an intrusion detection system, an index tree, wherein the index tree is configured to store one or more IP addresses and associated information in one or more nodes of the index tree in a predefined sorting order, wherein each node of the one or more nodes is assigned a predefined maximum size;
• receiving, by the intrusion detection system, structured data including a first set of one or more IP addresses from a honeypot system;
• receiving, by the intrusion detection system, unstructured data indicative of a second set of one or more IP addresses from a predefined data source;
• processing, by the intrusion detection system, the unstructured data to identify the second set of one or more IP addresses;
• and
• storing, by the intrusion detection system, the first set of one or more IP addresses and the second set of one or more IP addresses in the index tree according to the predefined maximum size for the one or more nodes, wherein each node of the one or more nodes includes a corresponding IP address level for each IP address of the first set of the one or more IP addresses and the second set of one or more IP addresses.