Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy
| Authors | |
|---|---|
| Year of publication | 2022 |
| Type | Article in Proceedings |
| Conference | The 17th International Conference on Availability, Reliability and Security (ARES 2022) |
| MU Faculty or unit | |
| Citation | |
| Web | https://doi.org/10.1145/3538969.3539007 |
| Doi | http://dx.doi.org/10.1145/3538969.3539007 |
| Keywords | cybersecurity;blacklist;limitation;prediction |
| Attached files | |
| Description | Blacklists (blocklists, denylists) of network entities (e.g., IP addresses, domain names) are popular approaches to preventing cyber attacks. However, the limited capacity of active network defense devices may not hold all the entries on a blacklist. In this paper, we evaluated two strategies to limit the size of a blacklist and their impact on the blacklist's accuracy. The first strategy is setting the maximal size of a blacklist; the second is setting an expiration time to blacklist items. Short-term attack predictions are typically more precise, and, thus, the recent blacklist entries should be more valuable than older ones. Our experiment shows that the blacklists reduced to half of the size via either strategy achieve only a 25% drop in accuracy. |
| Related projects: |