Patent ID: 11882137
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A computerized network security system, comprising:
hardware comprising a processor, a memory, a nonvolatile machine-readable storage medium, and a network interface; and
a blacklist generation module comprising instructions stored on the nonvolatile machine readable medium that when executed on the processor are operable to cause the computerized network security system to:
collect activity data from a plurality of honeypots comprising network address of attacks and time of attacks,
analyze activity data from plurality of honeypots to generate a score indicative of a predicted likelihood of future attack from network addresses in the activity data, and
construct a network address blacklist including network addresses predicted likely to be a source of a future attack based on the generated score being greater than a threshold value;
wherein the computerized network security system is configured to repeat the collecting, analyzing, and constructing over time such that each past threat is iteratively reassessed over time and the score indicative of a predicted likelihood of future attack is updated to reduce a size of maintaining the generated network address blacklist by removing the network addresses from the blacklist that had no recent honeypot attack activity based on the generated score.