Patent ID: 9083730
Filing Date: 2015-07-14
Classification: H04L

Abstract:
1. A method to identify a sub-netblock within a netblock, comprising: identifying, with a processor, a netblock associated with a malicious Internet protocol address, the netblock having a lower boundary and an upper boundary; collecting, with the processor, netflow data associated with a plurality of Internet protocol addresses in the netblock; establishing, with the processor, a first window associated with a lower portion of the plurality of Internet protocol addresses numerically lower than a candidate Internet protocol address; establishing, with the processor, a second window associated with an upper portion of the plurality of Internet protocol addresses numerically higher than the candidate Internet protocol address; calculating, with the processor, a divergence value between multinomial distribution values of the first window and the second window; calculating, with the processor, a breakpoint score based on the divergence value and a comparison between a behavioral profile of the first window and a behavioral profile of the second window; and identifying, with the processor, a first sub-netblock when the breakpoint score exceeds a threshold value.