A new service for increasing the effectiveness of network address blacklists

We recently established a new experimental Internet ser-vice for creating customized source address blacklists for DShield.org contributors. This new service utilizes a radically different approach to blacklist formulation that we refer to as Highly Predictive Blacklists (HPB). A highly predictive black-list is a list of malicious Internet addresses that is formulated through an analysis of the roughly 30 million firewall log en-tries that are contributed to the DShield repository each day from across the Internet. The HPB service employs a link anal-ysis algorithm similar to the Google PageRank scheme to cross-compare contributors in search of overlaps among the attackers they report. The attacker addresses included within an HPB are selected by favoring the inclusion of those addresses that have been encountered by contributors who share degrees of overlap with the target HPB owner. Our experiments show that highly predictive blacklist entries consistently yield filters that are ex-ercised at higher rates than those from conventional blacklist methods. In addition, this increase in blacklist filter “hit rates” can last multiple days into the future. In this paper, we provide an overview of our algorithm and present our usage experiences. We discuss the envisioned benefits that we believe HPBs can pro-vide toward reducing unwanted communications for those net-works that utilize this service.