Method and system for estimating the reliability of blacklists of botnet-infected computers

摘要

A system and a method for determining the reliability of blacklists is disclosed. Each blacklist comprises IP addresses of supposedly infected computers. The reliability is computed by analyzing whether the blacklist reports or not controlled infections from sandboxed environments and by measuring the elapsed time between reported infections and disinfections. The obtained information is then used in combination with several metrics for determining the trustworthiness of the IP address of a given Internet host that requests an online transaction with the purpose of granting or denying access to a service.