Highly predictive blacklisting

摘要: The notion of blacklisting communication sources has been a well-established defensive measure since the origins Internet community. In particular, practice compiling and sharing lists worst offenders unwanted traffic is strategy that remained virtually unquestioned over many years. But do individuals who incorporate such blacklists into their perimeter defenses benefit from contents as much they could other list-generation strategies? this paper, we will argue there exist better alternative blacklist generation strategies can produce higher-quality results for an individual network. introduce system based on relevance ranking scheme borrowed link-analysis produces customized choose to contribute data centralized log-sharing infrastructure. measures how closely related attack source contributor, using attacker's history contributor's recent log production patterns. also integrates substantive prefiltering severity metric captures degree which alert patterns match those common malware-propagation behavior. Our intent yield individualized not only significantly higher hit rates, but addresses pose greatest potential threat. We tested our corpus 700 million entries produced DShield center result shows enhance counts proactively attacker in timely fashion. An early form have fielded contributors last year.