IP Reputation Analysis of Public Databases and Machine Learning Techniques
Jared Lee Lewis, Geanina F. Tambaliuc, Husnu S. Narman, Wook-Sung Yoo · 2020 International Conference on Computing, Networking and Communications (ICNC) · 2020
As Internet usage is increasing worldwide, today's network is challenged with numerous cyber-attacks. An effective way to prevent users from cyber-attacks is to identify and create blacklists of those malicious domains. However, there are several issues related to the blacklist approach. Some authorized domains can mistakenly be added to blacklists, and some blacklist databases are not regularly maintained or updated. To solve these issues, we developed the Automated IP Reputation Analyzer Tool (AIPRA), a partly cross-checking system which automatically analyzes many reliable blacklist databases and assigns a weighted security degree of domains and IP addresses to inform users and applications about possibilities of malicious activities. However, there are some notable problems with blacklists, including false positives, inability to account for new malicious domains, and the constantly changing IP addresses of the malicious sites. To remedy this, we have tested four different machine learning approaches with several parameters, such as geolocation to analyze the performance of the approaches. Then, we integrate the geolocation-based machine learning approach into AIPRA to identify a malicious IP address or FQDN (Fully Qualified Domain Name). The results show that various public blacklist databases and machine learning techniques have significantly different results for the same set of IPs. While the results of machine learning methods can differ up to 25%, the blacklists result differ up to 80% differences for the same set of IPs. Therefore, our developed tool AIPRA is not only beneficial with crosscheck but also using machine learning to identify and eliminate the security issues which are caused by new harmful sites and outdated blacklists.