Methods and apparatus to identify an internet protocol address blacklist boundary

An apparatus to identify candidate boundaries of Internet protocol addresses associated with a malicious Internet protocol address comprising:

• a processor;
• and
• a memory to store machine readable instructions that, when executed by the processor, cause the processor to perform operations including:
• collecting netflow data associated with the Internet protocol addresses within a netblock having a lower boundary Internet protocol address and an upper boundary Internet protocol address;
• generating a first window of Internet protocol addresses numerically lower than the malicious Internet protocol address;
• generating a second window of Internet protocol addresses numerically higher than the malicious Internet protocol address;
• for respective Internet protocol addresses in the first and second windows, calculating occurrence counts associated with behavior features;
• and
• identifying candidate boundaries within the netblock based on divergence values caused by the behavior features.

A computer readable memory device comprising computer readable instructions that, when executed, cause a computer processor to perform operations comprising:

• collecting netflow data associated with the Internet protocol addresses within a netblock having a lower boundary Internet protocol address and an upper boundary Internet protocol address;
• generating a first window of Internet protocol addresses numerically lower than the malicious Internet protocol address;
• generating a second window of Internet protocol addresses numerically higher than the malicious Internet protocol address;
• for respective Internet protocol addresses in the first and second windows,
• calculating occurrence counts associated with behavior features;
• and
• identifying candidate boundaries within the netblock based on divergence values caused by the behavior features.