Attackers' Behavior Builds Better Blacklists Security Focus (07/24/08) Lemos, Robert
as it appeared in the August 1, 2008 edition of ACM TechNews.
Computer scientists at SRI International and the SANS Institute have developed the Highly Predictive Blacklist algorithm, a technique that determines an attacker's preference for victims' networks in order to prioritize additions to blacklists. The technique allows network owners to correlate attacks on their networks with attackers' preferences for other networks, using a system similar to Google's PageRank System. The researchers correlated attackers' choices in targets using firewall logs contributed by participants in the SANS Institute's DShield service. By matching the preferred victims of a known attacker, the researchers were able to develop per-network blacklists that perform better than either massive global lists or more focused local lists. "Our experiments demonstrate that our Highly Predictive Blacklist algorithm consistently creates firewall filters that are exercised at much higher rates than those from conventional blacklist methods," says SRI's Phillip Porras. The blacklists were created in three stages. First, the researchers removed any unreliable alerts from the logs submitted by contributors. Next, relevance-based rankings were used to prioritize attacks for each contributor. Lastly, the system gave priorities to patterns that match known malware propagation trends. The system was tested using 720 million log entries and found to outperform global and local blacklists in more than 80 percent of the cases. Click Here to View Full Article
