Patent ID: 8516595
Filing Date: 2013-08-20
Classification: H04L

Abstract:
1. A computer-implemented method for evaluating the reliability of blacklists from providers, a blacklist comprising a list of IP addresses of computers considered infected by a provider, the method comprising the steps of: gathering time of infection and IP address for each computer in a group of infected computers pertaining to a malware pool; fetching at least one blacklist from at least one provider; and for each blacklist of the at least one blacklist and for each computer in the group: checking whether there exists in the blacklist an IP address matching an IP address of a computer in the group and registering a first presence of each matching IP address in the blacklist, calculating a blacklist IP latency for the first presence of each matching IP address in the blacklist in dependence upon the time of infection of the computer having the IP address and the time of fetching the blacklist, estimating a blacklist reliability degree in dependence upon the number of matching IP addresses in the blacklist and the corresponding blacklist IP latencies.