Structuring data and pre-compiled exception list engines and internet protocol threat prevention
Blocking high-risk IP connections in real-time while allowing tailoring of an acceptable risk profile to match the security requirements of network resources. By acquiring IP threat information about IP addresses, traffic from IP addresses posing unacceptable levels of risk is blocked. A computer executed method is disclosed for sorting a plurality of internet protocol (IP) addresses. The method includes dividing the range of IP addresses into a plurality of clusters representing a plurality of contiguous sub-ranges, assigning each IP address to the cluster associated with the sub-range that includes that IP address, and assigning the IP addresses in each cluster to one of a plurality of pages. A network appliance incorporating aspects of the method is also disclosed.
1. A method of sorting a plurality of internet protocol (IP) addresses and filtering packets over a network connection based on the sorted IP addresses, each IP address having a numeric value within a range of numeric values, the method comprising:
dividing the range into a plurality of clusters representing a plurality of sub-ranges, each sub-range encompassing substantially the same number of numeric values of the range and each sub-range associated with a different cluster;
assigning each IP address to the cluster associated with the sub-range that includes the numeric value of said IP address, each cluster having a cluster size defined by the number of IP addresses assigned to that cluster;
assigning the IP addresses in each cluster to one of a plurality of pages, each page having a page size limit defining the maximum number of IP addresses that can be assigned to that page, and each page having a page size defined by the number of IP addresses assigned to that page, wherein at least one of the plurality of pages is assigned the IP addresses of a plurality of clusters such that the sum of the cluster sizes of the clusters of the assigned IP addresses is less than or equal to the page size limit of the page to which the IP addresses are assigned;
if one of said pages has a page size less than its page size limit, duplicating on said page at least one of the IP addresses assigned to that page to increase the page size of said page;
ordering, for each page, the IP addresses assigned to said page by numeric value;
generating at least one bloom filter for at least one page, the bloom filter identifying IP addresses that are not assigned to said page but are within a sub-range associated with said page;
receiving, over the network connection, a packet having a source IP address;
identifying whether the source IP address is assigned to the at least one page by checking the bloom filter generated therefor;
searching the at least one page only if the IP address is identified as being assigned thereto; and
determining whether to allow the packet to proceed over the network based on if the source IP address is an allowable IP address in the at least one page and to deny the packet from proceeding based on if the source IP address is a blocked IP address in the at least one page.
2. The method of claim 1 , further comprising mapping the bloom filter to a portion of the IP addresses associated with the at least one page, wherein each bit in the bloom filter is associated with one number of the IP address.
3. The method of claim 1 , wherein said generating the at least one bloom filter comprises generating a single bloom filter to be used for a plurality of pages comprising a set of pages, the single bloom filter identifying IP addresses that are not assigned to the set of pages.
4. The method of claim 1 , wherein said generating the at least one bloom filter comprises generating a plurality of bloom filters, wherein each of the plurality of bloom filters identifies IP addresses that are not assigned to at least one page.
5. The method of claim 4 , wherein a first bloom filter of the plurality of bloom filters is associated with a first number of an IP address and a second bloom filter of the plurality of bloom filters is associated with a second number of the IP address, wherein the first number is different from the second number.
6. The method of claim 4 , wherein a first bloom filter of the plurality of bloom filters is associated with one group of numbers of an IP address and a second bloom filter of the plurality of bloom filters is associated with a different group of numbers of the IP address.
7. The method of claim 1 , wherein the at least one page represents an internet risk intelligence provider (IRIP).
8. The method of claim 7 , further comprising denying the packet from proceeding when a risk category value associated with the source IP address is equal to or greater than a risk category acceptance level, wherein the risk category value associated with the source IP address is determined as a function of source characteristics and destination characteristics.
9. The method of claim 8 , wherein the source characteristics and the destination characteristics comprise at least one of: a geographic area, a country, a business sector, an industrial sector, and a political region.
10. A method of sorting a plurality of internet protocol (IP) addresses, each IP address having a numeric value within a range of numeric values, and filtering packets over a network connection based on the sorted IP addresses, the method comprising:
dividing the range into a plurality of clusters representing a plurality of sub-ranges, each sub-range encompassing substantially the same number of numeric values of the range and each sub-range associated with a different cluster;
assigning each IP address to the cluster associated with the sub-range that includes the numeric value of said IP address, each cluster having a cluster size defined by the number of IP addresses assigned to that cluster;
ordering the clusters by cluster size;
assigning the IP addresses in each cluster to one of a plurality of pages, each page having a same page size limit defining the maximum number of IP addresses that can be assigned to that page, and each page having a page size defined by the number of IP addresses assigned to that page, wherein at least one of the plurality of pages is assigned the IP addresses of a plurality of clusters such that the sum of the cluster sizes of the clusters of the assigned IP addresses is less than or equal to the page size limit of the page to which the IP addresses are assigned;
if one or more of said pages has a page size less than its page size limit, duplicating on said page one or more of the IP addresses assigned to that page to increase the page size of said page to its page size limit; and
ordering, for each page, the IP addresses assigned to said page by numeric value;
generating at least one bloom filter for at least one of said pages, the bloom filter identifying IP addresses that are not assigned to said page but are within a sub-range associated with said page;
receiving, over the network connection, a packet having a source IP address;
identifying whether the source IP address is assigned to the at least one page by checking the bloom filter generated therefor;
searching the at least one page only if the IP address is identified as being assigned thereto; and
determining whether to allow the packet to proceed based on if the source IP address is an allowable IP address in the at least one page and to deny the packet from proceeding if the source IP address is a blocked IP address in the at least one page.
11. The method of claim 10 , further comprising mapping the bloom filter to a portion of the IP addresses associated with the at least one page, wherein each bit in the bloom filter is associated with one number of the IP address.
12. The method of claim 10 , wherein said generating the at least one bloom filter comprises generating a single bloom filter to be used for a plurality of pages comprising a set of pages, the single bloom filter identifying IP addresses that are not assigned to the set of pages.
13. The method of claim 10 , wherein said generating the at least one bloom filter comprises generating a plurality of bloom filters, wherein each of the plurality of bloom filters identifies IP addresses that are not assigned to at least one page.
14. The method of claim 13 , wherein a first bloom filter of the plurality of bloom filters is associated with a first number of an IP address and a second bloom filter of the plurality of bloom filters is associated with a second number of the IP address, wherein the first number is different from the second number.
15. The method of claim 13 , wherein a first bloom filter of the plurality of bloom filters is associated with one group of numbers of an IP address and a second bloom filter of the plurality of bloom filters is associated with a different group of numbers of the IP address.
16. The method of claim 10 , wherein the at least one page represents an internet risk intelligence provider (IRIP).
17. The method of claim 16 , further comprising denying the packet from proceeding when a risk category value associated with the source IP address is equal to or greater than a risk category acceptance level, wherein the risk category value associated with the source IP address is determined as a function of source characteristics and destination characteristics.
18. The method of claim 17 , wherein the source characteristics and the destination characteristics comprise at least one of: a geographic area, a country, a business sector, an industrial sector, and a political region.