IP Reputation Scoring with Geo-Contextual Feature Augmentation

Abstract

The focus of this article is to present an effective anomaly detection model for an encrypted network session by developing a novel IP reputation scoring model that labels the incoming session IP address based on the most similar IP addresses in terms of both network and geo-contextual knowledge. We provide empirical evidence that considering not only traditional network information but also geo-contextual information provides better threat assessment. The reputation scores provide a means to quantitatively capture good and bad IP behavior, making our model ideal for detecting malicious network behavior. With network encryption being the most practical solution to data security and privacy today, our approach expands the network administrator's ability to make decisions about IP addresses' trustworthiness in an encrypted session with limited network information.

Towards Supercomputing Categorizing the Maliciousness upon Cybersecurity Blacklists with Concept Drift

“…This information is easy to extract and does not require a large volume of data. In this case, the models that are created are based on computations about the frequencies at which contextual information appears, or again, clustering techniques [16][17][18][19]. A global accuracy of 0.77 is reached to classify an IP address as malicious or not.…”

AI_Adaptive_POW: An AI assisted Proof Of Work (POW) framework for DDoS defense

“…AI_Adaptive_POW consists of four main modules and each module is lightweight and customizable. Our baseline framework uses an AI module called DaBR [2], to produce reputation scores which can be replaced by even more sophisticated reputation score calculation techniques (for example, see [5]). The AI model is trained using a list of known malicious IPs provided by Cisco Talos [3] which can be replaced by any other third party IP list service or an amalgamation of more than one lists.…”

How to build socio-organizational information from remote IP addresses to enrich security analysis?

“…To avoid these drawbacks, it is better to try to obtain more information about the sources before blocking its traffic. However, new blocklists using localization and political actualities [8] tend to have better results as they integrate context into the analysis.…”