Patent ID: 8161155

Claim:
A method for generating a customer blacklist associated with a customer system, comprising: generating, at a computer, a network blacklist comprising a first plurality of internet protocol addresses, the first plurality of internet protocol addresses identifying a plurality of unwanted traffic sources; generating a customer whitelist based on analyzing a customer historical usage pattern including traffic sources with repeatedly completed sessions and traffic sources with repeated initiated sessions, the customer whitelist comprising a second plurality of internet protocol addresses, the second plurality of internet protocol addresses identifying a plurality of wanted traffic sources; comparing each internet protocol address in the first plurality of internet protocol addresses with each internet protocol address in the second plurality of internet protocol addresses; and for each internet protocol address in the first plurality of internet protocol addresses: adding the internet protocol address to the customer blacklist if the internet protocol address is not in the second plurality of internet protocol addresses; and not adding the internet protocol address to the customer blacklist if the internet protocol address is in the second plurality of internet protocol addresses; wherein generating a network blacklist further comprises: acquiring a raw blacklist comprising a third plurality of internet protocol addresses identifying a third plurality of unwanted traffic sources; sorting the third plurality of internet protocol addresses according to prefix groups with a network-specified prefix length selected based on network-specified heuristics; rank ordering the prefix groups according to traffic frequency including number of connection attempts over a time interval; and selecting a set of top prefix groups based on the rank ordering for inclusion in the network blacklist.