Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy

Logo poskytovatele
Autoři

ŠUĽAN Samuel HUSÁK Martin

Rok publikování 2022
Druh Článek ve sborníku
Konference The 17th International Conference on Availability, Reliability and Security (ARES 2022)
Fakulta / Pracoviště MU

Ústav výpočetní techniky

Citace
Doi http://dx.doi.org/10.1145/3538969.3539007
Klíčová slova cybersecurity;blacklist;limitation;prediction
Přiložené soubory
Popis Blacklists (blocklists, denylists) of network entities (e.g., IP addresses, domain names) are popular approaches to preventing cyber attacks. However, the limited capacity of active network defense devices may not hold all the entries on a blacklist. In this paper, we evaluated two strategies to limit the size of a blacklist and their impact on the blacklist's accuracy. The first strategy is setting the maximal size of a blacklist; the second is setting an expiration time to blacklist items. Short-term attack predictions are typically more precise, and, thus, the recent blacklist entries should be more valuable than older ones. Our experiment shows that the blacklists reduced to half of the size via either strategy achieve only a 25% drop in accuracy.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.

Další info