US 8,554,907 B1 · Reputation prediction of IP addresses

Abstract

Daily query counts for e-mail messages sent from a number of IP addresses having unknown reputations are collected and logged, and optionally plotted. The logged query count data may optionally be normalized. The normalized query count data may also be plotted. The normalized data is divided into regions (numerically or graphically). Next, the divided regions are tagged (symbolically or graphically) with unique, symbolic identifiers such as letters, numbers, symbols or colors. Patterns for each unknown IP address are formed based upon the tagged regions. Common good and bad patterns are also identified for known good and bad IP addresses. The reputation of these unknown IP addresses are then predicted using these identified good and bad patterns using a suffix tree (for example). Finally, an output identifying the determined reputations of these unknown IP addresses is generated and output.

Claims20

Dependent claims

A method of predicting the reputation of a single computer network resource, said method comprising:

for said computer network resource having an unknown reputation, receiving count values of computer network traffic originating periodically from said single computer network resource;
identifying a plurality of unique symbolic identifiers, each symbolic identifier representing a unique numerical range of possible count values;
assigning to each of said count values one of said symbolic identifiers, said each count value falling within the unique numerical range of said assigned symbolic identifier;
forming a chronological sequence of said assigned symbolic identifiers for said computer network resource of unknown reputation, said chronological sequence ordered based upon when said computer network traffic originates;
receiving a fixed sequence of a subset of said symbolic identifiers that represents computer network traffic of a known network resource identified as being malicious;
determining that said fixed sequence matches with a substring of said chronological sequence;
and
when it is determined said fixed sequence matches, outputting an indication of said match.

5 more elements

Dependencies are inferred from the claim text.

Reputation prediction of IP addresses

Life of this patent

Reputation prediction of IP addresses

Life of this patent

Abstract

Claims20