Method for assessing the quality of network-related indicators of compromise

A method for assessing the quality of network-related Indicators of Compromise comprising the following phases:

• importing, by computerized data processing unit, one or more Indicators of Compromise;
• classification, by said computerized data processing unit, of each of said Indicators of Compromise as IP Address, Domain Name and URL type;
• storing, in a storage unit of the permanent type operatively connected to said data processing unit, said classified Indicators of Compromise of IP Address, Domain Name and URL type;
• calculating, by said computerized data processing unit, a quality score for each of said classified Indicators of Compromise of the IP Address, Domain Name and URL type;
• storing, in said storage unit of the permanent type, said quality score of each of said classified Indicators of Compromise of the IP Address, Domain Name and URL type;
• evaluating, by said computerized data processing unit, said calculated quality score for each of said classified Indicators of Compromise of the IP Address, Domain Name and URL type;
• wherein said phase of calculating said quality score comprises, for each of said Indicators of Compromise of the IP Address type, the following steps:
• assigning an autonomous system score of said IP Address according to a predefined range of values based on a database of autonomous system owners;
• assigning a subnet score of said IP Address according to a predefined range of values based on a database of subnet owners;
• assigning a services hosted score of said IP Address according to a predefined range of values based on known malicious services hosted by said IP Address before said phase of calculating said quality score;
• calculating said IP Address quality score as sum of said autonomous system score, subnet score and services hosted score;
• and
• wherein said phase of evaluating said calculated quality score comprises, for each of said Indicators of Compromise of the IP Address type, the step of assessing said Indicators of Compromise of the IP Address type as malicious when said IP Address quality score exceed a predefined IP Address quality threshold.