Detect Malicious IP Addresses using Cross-Protocol Analysis
Yonghong Huang, Joanna Negrete, Adam Wosotowsky, John Wagener, Eric Peterson, Armando L Rodriguez, Celeste Fralick · 2019
From the fundamentals of the domain name system (DNS) system, to the websites we browse, the files we download, and emails we receive, every aspect of our online lives involves connections to internet resources. As a result, the Internet protocol (IP) Address is a pivotal component for risk assessment of online exchanges. Our goal in this study is to develop large- scale classification of malicious IPs that leverages cross-protocol telemetry to produce accurate and context-aware risk assessment. We developed an IP reputation system for generic IP addresses based on real-world data. We added interpretability to our machine learning solution to infer a malicious IP address. Our results show that the cross-protocol analysis achieves exceptional testing performance and is effective in real-world application to detect malicious IP addresses.