Scientists use e-commerce techniques to block attacks

Highly predictive blacklisting uses data from past attacks to deal with current threats

Scientists from the University of California, Irvine have published a paper about a technique borrowed from e-commerce that could stop virus attacks by prediction.

The technique, called 'highly predictive blacklisting', uses data from past attacks to map out a pattern of the way viruses spread through systems. Once it recognises suspicious activity, the system copes with the threat by blacklisting the site that delivered the malware.

"We propose a multi-level prediction model that is adjusted and tuned specifically for the attack forecasting problem," said Fabio Soldo, Anh Le and Athina Markopoulou, the authors of the paper, entitled Predictive Blacklisting as an Implicit Recommendation System.

"Our model captures and combines various factors, namely: attacker-victim history (using time-series) and attackers and/or victims interactions (using neighbourhood models)."

The team took Amazon's predictive model as its inspiration, in which customers are recommended books that they may like based on past purchases. In practice, the team used a Google PageRank-type algorithm to find and block the most common attack vectors.

The researchers tested the system on a dataset of one month's worth of logs consisting of hundreds of millions of security logs from hundreds of networks.

The team claimed that the new technique improves on current state-of-the-art blacklisting systems by 70 per cent, and that there is plenty of room for improvement.