Patent ID: 8438638

Claim:
A method for determining whether an internet protocol address is part of a bot-network, the method comprising: determining an internet protocol-address-aggregate associated with the internet protocol-address; associating the internet protocol-address-aggregate with an internet protocol-address-aggregate-category of a plurality of internet protocol-address-aggregate-categories based on simple mail transfer protocol traffic characteristics of the internet protocol-address-aggregate and simple mail transfer protocol traffic characteristics of the internet protocol-address-aggregate-category, wherein the simple mail transfer protocol traffic characteristics comprise: a number of black-listed e-mail senders within a period of time; a simple mail transfer protocol entropy within the period of time; a number of active unique e-mail senders adjusted for internet protocol-address-aggregate simple mail transfer protocol inactivity; and a number of active unique e-mail senders adjusted for individual e-mail sender inactivity given a simple mail transfer protocol-active internet protocol-address-aggregate; and assigning a bot-likelihood score of the internet protocol-address-aggregate-category to the internet protocol-address-aggregate.