Limiting the Size of a Predictive Blacklist While Maintaining
Sufficient Accuracy

D 2022

Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy

ŠUĽAN, Samuel a Martin HUSÁK

Základní údaje

Originální název

Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy

Autoři

ŠUĽAN, Samuel a Martin HUSÁK

Vydání

Vienna, The 17th International Conference on Availability, Reliability and Security (ARES 2022), od s. "22:1"-"22:6", 6 s. 2022

Nakladatel

ACM

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10200 1.2 Computer and information sciences

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14610/22:00126039

Organizační jednotka

Ústav výpočetní techniky

ISBN

978-1-4503-9670-7

Klíčová slova anglicky

cybersecurity;blacklist;limitation;prediction

Štítky

core_B, firank_B, rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 14. 5. 2024 09:55, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

Blacklists (blocklists, denylists) of network entities (e.g., IP addresses, domain names) are popular approaches to preventing cyber attacks. However, the limited capacity of active network defense devices may not hold all the entries on a blacklist. In this paper, we evaluated two strategies to limit the size of a blacklist and their impact on the blacklist's accuracy. The first strategy is setting the maximal size of a blacklist; the second is setting an expiration time to blacklist items. Short-term attack predictions are typically more precise, and, thus, the recent blacklist entries should be more valuable than older ones. Our experiment shows that the blacklists reduced to half of the size via either strategy achieve only a 25% drop in accuracy.

Návaznosti

EF16_019/0000822, projekt VaV

Název: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur

Přiložené soubory

2022-ARES-Short-Predictive_blacklisting.pdf Verze souboru

2022-ARES-Short_Predictive_Blacklisting-slides.pdf

Citovat

ŠUĽAN, Samuel a Martin HUSÁK. Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy. Online. In The 17th International Conference on Availability, Reliability and Security (ARES 2022). Vienna: ACM, 2022, s. "22:1"-"22:6", 6 s. ISBN 978-1-4503-9670-7. Dostupné z: https://doi.org/10.1145/3538969.3539007.

@inproceedings{1860605,
   author = {Šuľan, Samuel and Husák, Martin},
   address = {Vienna},
   booktitle = {The 17th International Conference on Availability, Reliability and Security (ARES 2022)},
   doi = {https://doi.org/10.1145/3538969.3539007},
   keywords = {cybersecurity;blacklist;limitation;prediction},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Vienna},
   isbn = {978-1-4503-9670-7},
   pages = {"22:1"-"22:6"},
   publisher = {ACM},
   title = {Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy},
   url = {https://doi.org/10.1145/3538969.3539007},
   year = {2022}
}

TY  - CONF
ID  - 1860605
AU  - Šuľan, Samuel - Husák, Martin
PY  - 2022
TI  - Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy
PB  - ACM
CY  - Vienna
SN  - 9781450396707
KW  - cybersecurity;blacklist;limitation;prediction
UR  - https://doi.org/10.1145/3538969.3539007
N2  - Blacklists (blocklists, denylists) of network entities (e.g., IP addresses, domain names) are popular approaches to preventing cyber attacks. However, the limited capacity of active network defense devices may not hold all the entries on a blacklist. In this paper, we evaluated two strategies to limit the size of a blacklist and their impact on the blacklist's accuracy. The first strategy is setting the maximal size of a blacklist; the second is setting an expiration time to blacklist items. Short-term attack predictions are typically more precise, and, thus, the recent blacklist entries should be more valuable than older ones. Our experiment shows that the blacklists reduced to half of the size via either strategy achieve only a 25% drop in accuracy.
ER  -

ŠUĽAN, Samuel a Martin HUSÁK. Limiting the Size of a Predictive Blacklist While Maintaining Sufficient Accuracy. Online. In \textit{The 17th International Conference on Availability, Reliability and Security (ARES 2022)}. Vienna: ACM, 2022, s.~''22:1''-''22:6'', 6 s. ISBN~978-1-4503-9670-7. Dostupné z: https://doi.org/10.1145/3538969.3539007.

Přehled o publikaci