Resumen de Highly predictive blacklisting
Jian Zhang, Phillip Porras, Johannes Ullrich
We introduce the highly predictive Blacklist (HPB) service, which is now integrated into DShield.org portal [1] The HPB service employs a radically different approach to blacklist formulation than that a contemporary blacklist formulation strategies. At the core of the system is a ranking scheme that measures how closely related an attack source is to a blacklist consumer, based on both the attacker's history and the most recent firewall log production pattern of the consumer. Our objective is to construct a customized blacklist per repository contributor that reflects the most probable set of adresses that may attack the contributor in the near future. We view this service as a first experimental step toward a new direction in high-quality blacklist generation.
