Mechanism for establishing reputation in a network environment

1. A method comprising the steps of:

obtaining traffic from a plurality of internet protocol version six addresses within a plurality of internet protocol version six blocks;

obtaining a first indication of inappropriate traffic from a first one of said internet protocol version six addresses;

responsive to said first indication of inappropriate traffic:

incrementing a reputation score for a first block of said blocks, containing said first one of said internet protocol version six addresses, by a first predetermined amount; and

incrementing a reputation score for a plurality of pairs of blocks adjacent to said first block in said internet protocol version six addresses using successively smaller predetermined amounts for each of said pair of blocks successively farther from said first block, wherein each of said successively smaller predetermined amounts is less than said first predetermined amount, wherein blocks of a given pair of blocks have respective addresses separated by said first one of said internet protocol version six addresses; and

passing or blocking said traffic from said plurality of internet protocol version six addresses within said plurality of internet protocol version six blocks, in accordance with a policy based on said incremented reputation scores for said first block and said plurality of pairs of blocks adjacent to said first block.

2. The method of claim 1 , wherein, in said incrementing steps, said first block and each block of said plurality of pairs of blocks comprise smallest delegable blocks in said internet protocol version six.

3. The method of claim 2 , wherein, in said incrementing steps, said first block and each block of said plurality of pairs of blocks comprise 64-bit blocks.

4. The method of claim 1 , further comprising:

obtaining a second indication of inappropriate traffic from a second one of said internet protocol version six addresses;

responsive to said second indication of inappropriate traffic:

incrementing a reputation score for a second block of said blocks, containing said second one of said internet protocol version six addresses, by said first predetermined amount; and

incrementing a reputation score for a plurality of pairs of blocks adjacent to said second block in said internet protocol version six addresses using said successively smaller predetermined amounts for each of said pair of blocks successively farther from said second block;

wherein said passing or blocking of said traffic is further in accordance with said incremented reputation scores for said second block and said plurality of pairs of blocks adjacent to said second block.

5. The method of claim 4 , further comprising assigning initial values of said reputation score to at least a portion of said plurality of internet protocol version six blocks.

6. The method of claim 5 , wherein said initial values comprise zero.

7. The method of claim 4 , wherein said passing or blocking of said traffic in accordance with said incremented reputation scores for said first block, said plurality of pairs of blocks adjacent to said first block, said second block and said plurality of pairs of blocks adjacent to said second block comprises computing a total reputation score for at least said first block, said plurality of pairs of blocks adjacent to said first block, said second block and said plurality of pairs of blocks adjacent to said second block, passing traffic for which a total reputation score threshold value is not exceeded, and blocking traffic for which said total reputation score threshold value is exceeded.

8. The method of claim 7 , further comprising, after passage of a predetermined time during which none of said inappropriate traffic is received, allowing decay of said total reputation score.

9. The method of claim 7 , wherein said first predetermined amount comprises a first integer and said successively smaller predetermined amounts comprise respective integers.

10. The method of claim 7 , wherein said threshold value is selected to block said traffic for any given one of said internet protocol version six blocks having at least one instance of said inappropriate traffic.

11. The method of claim 1 , wherein said step of incrementing said reputation score for said plurality of pairs of blocks is carried out contemporaneously with said step of incrementing said reputation score for said first given one of said blocks.

12. The method of claim 1 , wherein said step of incrementing said reputation score for said plurality of pairs of blocks is carried out on the fly, on an as-needed basis, after said step of incrementing said reputation score for said first given one of said blocks.

13. The method of claim 1 ,

wherein:

said obtaining of said traffic is carried out by a network port of a system;

said incrementing of said reputation score for said first block and said plurality of pairs of blocks is carried out by a score calculation module executing on at least one hardware processor of said system, said score calculation module being embodied on a non-transitory computer-readable recordable storage medium of said system; and

said passing or blocking of said traffic is controlled by a traffic policing module executing on said at least one hardware processor, said traffic policing module being embodied on said non-transitory computer-readable recordable storage medium of said system.

14. The method of claim 1 ,

wherein:

said obtaining of said traffic is carried out by a network port of a system;

said incrementing of said reputation score for said first block and said plurality of pairs of blocks is carried out by a policy engine module, in cooperation with a scoring process module, executing on at least one hardware processor of said system, said policy engine module and said scoring process module being embodied on one or more non-transitory computer-readable recordable storage medium of said system; and

said passing or blocking of said traffic is controlled by said policy engine module executing on said at least one hardware processor.

15. An apparatus comprising:

at least one hardware processor;

at least one network port coupled to the at least one hardware processor;

at least one memory coupled to the at least one processor; and

at least two distinct software modules, each of the distinct software modules being embodied on a tangible computer-readable recordable storage medium, and wherein the distinct software modules comprise a score calculation module and a traffic policing module;

wherein:

said at least one network port is configured to obtain traffic from a plurality of internet protocol version six addresses within a plurality of internet protocol version six blocks;

said at least one processor is configured to obtain a first indication of inappropriate traffic from a first one of said internet protocol version six addresses;

said score calculation module, when loaded into said memory, causes said at least one hardware processor, in response to said first indication of inappropriate traffic, to:

increment a reputation score for a first block of said blocks, containing said first one of said internet protocol version six addresses, by a first predetermined amount; and

increment a reputation score for a plurality of pairs of blocks adjacent to said first block in said internet protocol version six addresses using successively smaller predetermined amounts for each of said pair of blocks successively farther from said first block, wherein each of said successively smaller predetermined amounts is less than said first predetermined amount, wherein blocks of a given pair of blocks have respective addresses separated by said first one of said internet protocol version six addresses; and

said traffic policing module, when loaded into said memory, causes said at least one hardware processor to pass or block said traffic from said plurality of internet protocol version six addresses within said plurality of internet protocol version six blocks, in accordance with a policy based on said incremented reputation scores for said first block and said plurality of pairs of blocks adjacent to said first block.

16. The apparatus of claim 15 , wherein said score calculation module, when loaded into said memory, causes said at least one hardware processor to increment said reputation score for said plurality of pairs of blocks contemporaneously with said incrementing of said reputation score for said first block.

17. The apparatus of claim 15 , wherein said score calculation module, when loaded into said memory, causes said at least one hardware processor to increment said reputation score for said plurality of pairs of blocks on the fly, on an as-needed basis, after said incrementing of said reputation score for said first block.

18. The apparatus of claim 15 , wherein, in said incrementing, said first block and each block of said plurality of pairs of blocks comprise smallest delegable blocks in said internet protocol version six.

19. The apparatus of claim 18 , wherein, in said incrementing, said first block and each block of said plurality of pairs of blocks comprise 64-bit blocks.

20. The apparatus of claim 15 , wherein score calculation module, when loaded into said memory, causes said at least one hardware processor, in response to said first indication of inappropriate traffic, to iterate said incrementing recursively.