Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy

Investor logo

Warning

This publication doesn't include Faculty of Economics and Administration. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

ŠUĽAN Samuel HUSÁK Martin

Year of publication 2022
Type Article in Proceedings
Conference The 17th International Conference on Availability, Reliability and Security (ARES 2022)
MU Faculty or unit

Institute of Computer Science

Citation
Web https://doi.org/10.1145/3538969.3539007
Doi http://dx.doi.org/10.1145/3538969.3539007
Keywords cybersecurity;blacklist;limitation;prediction
Attached files
Description Blacklists (blocklists, denylists) of network entities (e.g., IP addresses, domain names) are popular approaches to preventing cyber attacks. However, the limited capacity of active network defense devices may not hold all the entries on a blacklist. In this paper, we evaluated two strategies to limit the size of a blacklist and their impact on the blacklist's accuracy. The first strategy is setting the maximal size of a blacklist; the second is setting an expiration time to blacklist items. Short-term attack predictions are typically more precise, and, thus, the recent blacklist entries should be more valuable than older ones. Our experiment shows that the blacklists reduced to half of the size via either strategy achieve only a 25% drop in accuracy.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.