INTERNET PROTOCOL THREAT PREVENTION

摘要

Blocking high-risk IP connections in real-time while allowing tailoring of an acceptable risk profile to match the security requirements of network resources. By acquiring IP threat information about IP addresses, including risk confidence levels, assigning weighting factor values corresponding to various characteristics of the IP addresses, and mathematically transforming the risk confidence levels using the weighting factor values, traffic from IP addresses posing unacceptable levels of risk is blocked. Further, mathematically transforming risk confidence level to a user-defined acceptable risk level permits allowing traffic from the IP addresses having an acceptable level of risk.

主权项

1. A computer-implemented method of assessing a risk associated with an Internet Protocol (IP) address for a risk category, the method comprising:
storing a plurality of threat information in a memory device, the threat information including the IP address, a risk category associated with the IP address, and a risk confidence level associated with the IP address; storing a risk category acceptance level in the memory device; determining a risk category value associated with the IP address as a function of:
the risk confidence level, andtiming information, said timing information comprising:
a number of instances the risk confidence level has exceeded the risk category acceptance level during a first time interval, anda second time interval representing the elapsed time since the risk confidence level previously exceeded the risk category acceptance level; storing the risk category value in the memory device; and determining an action associated with the IP address for the risk category as a function of the risk category value and the risk category acceptance level.