Patent ID: 11882137
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method of generating a network address blacklist, comprising:
collecting activity data in a plurality of honeypots comprising network address of attacks and time of attacks;
analyzing activity data from the plurality of honeypots to generate a score indicative of a predicted likelihood of future attack from network addresses in the activity data; and
constructing a network address blacklist including network addresses predicted likely to be a source of a future attack based on the generated score being greater than a threshold value;
wherein the collecting, analyzing, and constructing are repeated over time such that each past threat is iteratively reassessed over time and the score indicative of a predicted likelihood of future attack is updated to reduce a size of maintaining the generated network address blacklist by removing the network addresses from the blacklist that had no recent honeypot attack activity based on the generated score.