# US 9,438,626 B1 · Risk scoring for internet protocol networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,626 B1 - Document ID: US9438626B1 - Status: Granted - Kind: B1 - Application number: 13/920,500 - Filed: 2013-06-18 - Granted: 2016-09-06 - Earliest claimed: 2013-06-18 - Assignees: EMC Corporation - Applicants: EMC Corporation - Inventors: Ido Zilberberg; Lior Asher; Alex Zaslavsky; Marcelo Blatt - Web page: https://patentgrep.com/patent/US9438626B1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, apparatus and articles of manufacture for risk scoring for internet protocol networks are provided herein. A method includes identifying a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information, determining each of one or more network elements previously identified as belonging to the network, and calculating a risk score assigned to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) risk-related information corresponding to each of the one or more network elements previously identified as belonging to the network. ## Claims ### Claim 1 A method comprising: identifying a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period; determining each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period; calculating a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and wherein said calculating further comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information; applying the risk score assigned to the network to (i) the first network element and (ii) to each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network; and iteratively updating the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network; wherein the steps are carried out by at least one computing device. ### Claim 2 (depends on 1) The method of claim 1, wherein each of said network elements comprises an internet protocol address. ### Claim 3 (depends on 1) The method of claim 1, wherein said identifying comprises searching one or more network databases to identify an entry corresponding to the first network element. ### Claim 4 (depends on 1) The method of claim 1, wherein said identifying comprises receiving an entry corresponding to the first network element directly from a customer. ### Claim 5 (depends on 1) The method of claim 1, wherein said determining comprises analyzing information pertaining to the network to identify each previously identified network element belonging thereto. ### Claim 6 (depends on 1) The method of claim 1, wherein said first network element is identified as having participated in fraudulent activity by an entity reporting said first network element to a fraud detection system. ### Claim 7 (depends on 1) The method of claim 1, wherein said risk-related information corresponding to the first network element comprises a risk score assigned to the first network element, and wherein said risk-related information corresponding to each of the multiple network elements previously identified as belonging to the network comprises a risk score assigned to each of the multiple network elements previously identified as belonging to the network. ### Claim 8 An article of manufacture comprising a non-transitory processor-readable storage medium having processor-readable instructions tangibly embodied thereon which, when implemented, cause a processor to carry out steps comprising: identifying a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period; determining each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period; calculating a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and wherein said calculating further comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information; applying the risk score assigned to the network to (i) the first network element and (ii) to each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network; and iteratively updating the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network. ### Claim 9 (depends on 8) The article of manufacture of claim 8, wherein each of said network elements comprises an internet protocol address. ### Claim 10 (depends on 8) The article of manufacture of claim 8, wherein said identifying comprises searching one or more network databases to identify an entry corresponding to the first network element. ### Claim 11 (depends on 8) The article of manufacture of claim 8, wherein said identifying comprises receiving an entry corresponding to the first network element directly from a customer. ### Claim 12 (depends on 8) The article of manufacture of claim 8, wherein said determining comprises analyzing information pertaining to the network to identify each previously identified network element belonging thereto. ### Claim 13 An apparatus comprising: a memory; and at least one processor coupled to the memory and configured to: identify a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period; determine each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period; calculate a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and wherein said calculating further comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information; apply the risk score assigned to the network to (i) the first network element and (ii) to each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network; and iteratively update the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network. ### Claim 14 (depends on 13) The apparatus of claim 13, further comprising: one or more databases for storing risk-related information pertaining to one or more network elements. ### Claim 15 (depends on 13) The apparatus of claim 13, further comprising: one or more databases for storing risk-related information pertaining to one or more networks. ### Claim 16 A method comprising: obtaining an item of input data from an entity, wherein said item of input data comprises identification of a first network element and corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period; identifying a network to which the first network element belongs; determining each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period; calculating a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network based on (i) the risk-related information corresponding to the first network element, (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and (iii) one or more items of information pertaining to a level of trust associated with the entity, wherein said calculating comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information; applying the risk score assigned to the network to (i) the first network element and to (ii) each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network; and iteratively updating the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network; wherein the steps are carried out by at least one computing device. ### Claim 17 (depends on 16) The method of claim 16, wherein said first network element comprises an internet protocol address. ### Claim 18 (depends on 16) The method of claim 16, wherein said risk-related information corresponding to the first network element comprises a risk score assigned to the first network element. ### Claim 19 (depends on 16) The method of claim 16, wherein each of the one or more network elements previously identified as belonging to the network comprises an internet protocol address. ### Claim 20 (depends on 16) The method of claim 16, wherein said risk-related information corresponding to each of the multiple network elements previously identified as belonging to the network comprises a risk score assigned to each of the multiple network elements.