Highly predictive blacklisting

• Autores: Jian Zhang, Phillip Porras, Johannes Ullrich
• Localización: ;login:: the magazine of USENIX & SAGE, ISSN 1044-6397, Vol. 33, Nº. 6 (DIC), 2008, págs. 21-28
• Idioma: inglés
• Texto completo no disponible (Saber más ...)
• Resumen

  • We introduce the highly predictive Blacklist (HPB) service, which is now integrated into DShield.org portal [1] The HPB service employs a radically different approach to blacklist formulation than that a contemporary blacklist formulation strategies. At the core of the system is a ranking scheme that measures how closely related an attack source is to a blacklist consumer, based on both the attacker's history and the most recent firewall log production pattern of the consumer. Our objective is to construct a customized blacklist per repository contributor that reflects the most probable set of adresses that may attack the contributor in the near future. We view this service as a first experimental step toward a new direction in high-quality blacklist generation.