Using IP address data to detect malicious activities
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting malicious activities. One of the methods includes obtaining a collection of user event logs or receiving user events through real-time feeds; using data from the user event logs/feeds to determine IP address properties for individual IP addresses and IP address ranges; and for each incoming event, updating the IP address properties for the corresponding IP address and IP prefix properties.
1. A method comprising:
obtaining a collection of user event logs or receiving user events through real-time feeds;
processing data from the user event logs/feeds to compute a plurality of IP address properties that comprise particular features associated with one or more individual IP addresses and one or more IP address ranges, wherein the IP address properties include a predictable IP address property for a particular user for each IP address the user has used, wherein each predictable IP address property for the particular user corresponds to a calculated probability that the particular user will use a specific IP address or IP address range again based on prior IP address usage; and
for each of one or more subsequent incoming events, updating the computed IP address properties for the corresponding IP address and IP address ranges including the predicable IP address property for the particular user based on the data from the incoming events; and
using the plurality of IP address properties to calculate a probability that events associated with particular IP addresses or IP address ranges are malicious.
2. The method of claim 1 , further comprising, using the IP address properties to perform attack detection.
3. The method of claim 1 , wherein the determined IP address properties for one or more users includes the respective user's predictable IP address or IP address range that the user is likely to use in the future with a high probability based on the user IP address history.
4. The method of claim 3 , wherein the predictable IP address of a user is used to determine a likelihood of a compromised or fake user account.
5. The method of claim 3 , wherein determining the user's predictable IP address or IP address range comprises:
determining a frequency at which the user uses a particular IP address or IP range; and
calculating the probability of the user using the particular IP address or IP range based on a calculated confidence interval of future appearance using the determined frequency.
6. The method of claim 1 , wherein the determined IP address properties for one or more users includes determining, for one or more users, a user co-login property that is used to derive correlations/similarities of users and user activities on a particular IP address.
7. A system comprising:
one or more computers configured to perform operations comprising:
obtaining a collection of user event logs or receiving user events through real-time feeds;
processing data from the user event logs/feeds to compute a plurality of IP address properties which comprise particular features associated with one or more individual IP addresses and one or more IP address ranges, wherein the IP address properties include a predictable IP address property for a particular user for each IP address the user has used, wherein each predictable IP address property for the particular user corresponds to a calculated probability that the particular user will use a specific IP address or IP address range again based on prior IP address usage; and
for each of one or more subsequent incoming events, updating the computed IP address properties for the corresponding IP address and IP address ranges including the predicable IP address property for the particular user based on the data from the incoming events; and
using the plurality of IP address properties to calculate a probability that events associated with particular IP addresses or IP address ranges are malicious.
8. The system of claim 7 , further comprising, using the IP address properties to perform attack detection.
9. The system of claim 7 , wherein the determined IP address properties for one or more users includes the respective user's predictable IP address or IP address range that the user is likely to use in the future with a high probability based on the user IP address history.
10. The system of claim 9 , wherein the predictable IP address of a user is used to determine a likelihood of a compromised or fake user account.
11. The system of claim 9 , wherein determining the user's predictable IP address or IP address range comprises:
determining a frequency at which the user uses a particular IP address or IP range; and
calculating the probability of the user using the particular IP address or IP range based on a calculated confidence interval of future appearance using the determined frequency.
12. The system of claim 7 , wherein the determined IP address properties for one or more users includes determining, for one or more users, a user co-login property that is used to derive correlations/similarities of users and user activities on a particular IP address.
13. The system of claim 12 , wherein determining user co-login comprises:
calculating a likelihood of user co-login based on the likelihood of each user using a particular IP address and the number of user co-loin to the IP address during a specified time frame.