Automatically identifying dynamic internet protocol addresses

摘要

Dynamic IP addresses may be automatically identified and their dynamics patterns may be analyzed. Multi-user IP address blocks are determined as candidates for further analysis. An entropy score is determined for each IP address in every candidate block to distinguish between a dynamic IP and a static IP shared by multiple users. IP addresses with high entropy scores are grouped, and then analyzed, and may be used in various applications, such as spam filtering.

主权项

1. A method of identifying, among a set of candidate IP addresses, which IP addresses are dynamic Internet protocol (IP) addresses, the method performed by a computing device, the method comprising:
generating, by a processor of the computing device, a candidate IP address block comprised of IP addresses; computing, by the processor, usage metrics for respective IP addresses in the candidate IP address block, the computing based on usage information from which it can be determined whether any two different IP addresses in the candidate IP address block were used by a same user and whether any IP address in the IP address block was used by two different users; and making, by the processor, a decision that the IP address block from the candidate IP address block consists of dynamic IP addresses that are of a type that are temporarily assigned to devices, wherein the decision is made based on the usage metrics, and storing an indication of the determining with respect to the IP address block in a storage of the computing device.