Highly Predictive Blacklisting

1. Highly Predictive Blacklisting 5/10 黃瀚嶙

2. Introduction • GWOL-global worst offender list • LWOL-local worst offender list • HPB -highly predictive blacklisting

3. References • Highly Predictive Blacklisting Jian Zhang, Phillip Porras, and Johannes Ullrich. Highly predictive blacklisting. In Usenix Security Symposium, 2008.

4. Blacklisting System-flow chart

5. Blacklisting System -Prefiltering Logs • remove invalid or unassigned IP address space -like 10.x.x.x or 192.168.x.x • use the whitelist • exclude specific port -TCP 53 (DNS), 25 (SMTP), 80 (HTTP)…etc

6. Blacklisting System -Relevance Ranking

7. Blacklisting System -Relevance Ranking

8. Blacklisting System -Relevance Ranking • relevance vector • Thers is a fast solution like • the rank of a source with respect to different contributors is different

9. Blacklisting System -Attack Pattern Severity • cm:total num of attack port, cu :total num of unique port • wm, wu : the weight of Cm Cu • TC(s):unique target IP addresses connected to by attacker s. • malware severity score

10. Blacklisting System -Blacklist Production • final blacklist for each contributor -k :relevance rank of the attacker -L:final list length

11. Experiment Results-Hit Count Improvement • 1

12. Experiment Results-Prediction of New Attacks • 1

13. Experiment Results-Blacklist Length

14. Conclusion • new attacker prediction quality • new system to generate blacklists