Highly Predictive Blacklists

SANS Internet Storm Center has a service for DShield log contributors called HPBs (Highly Predictive Blacklists). Since their summary is succinct enough I will just quote it here:

DShield.org in collaboration with SRI International has established a new experimental custom source address blacklist generation service available to all DShield.org contributors. This new service utilizes a radically different approach to blacklist formulation called Highly Predictive Blacklisting. Each DShield contributor can now access a unique HPB (instructions below) that reflects the most probable set of source addresses that will connect to that contributor’s network over a prediction window that may last several days into the future.

Highly predictive blacklists employ a link analysis algorithm similar to Google’s PageRank scheme used to find the most relevant web pages given a user’s query. Similar to a web query, DShield contributor’s firewall logs are cross-compared in search of overlaps among the attackers they report. Each attacker address that is included in an HPB is selected by favoring those ad-dresses that are encountered by other contributors that share degrees of overlap with the HPB owner.

How does it work (for non math geeks 😉 ): We compare your firewall logs to firewall logs submitted by others. If you and other submitters are hit on similar ports, then your are more likely to be attacked by the same IPs. Your personal “HPB” is created from the IP addresses that target submitters with similar reports as you.

While this is directly useful to firewall administrators, the concept could potentially be extended to other domains/uses too. Filing this under “bag of tricks” for now 😀

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s