Automatically identifying dynamic Internet protocol addresses

• US 20080320119A1
• Filed: 06/22/2007
• Published: 12/25/2008
• Est. Priority Date: 06/22/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Achan, Kannan, Gillum, Eliot, Yu, Fang, Xie, Yinglian
• Granted Patent: US 8,856,360 B2
• Time in Patent Office: Days
• US Class Current: 709/222
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Dynamic IP addresses may be automatically identified and their dynamics patterns may be analyzed. Multi-user IP address blocks are determined as candidates for further analysis. An entropy score is determined for each IP address in every candidate block to distinguish between a dynamic IP and a static IP shared by multiple users. IP addresses with high entropy scores are grouped, and then analyzed, and may be used in various applications, such as spam filtering.

Claims

1. A method of identifying dynamic Internet protocol (IP) addresses, comprising:

determining a candidate IP address block;

determining a usage entropy for each IP address in the candidate IP address block; and

identifying a dynamic IP address block from the candidate IP address block based on the determined usage entropies.

2. The method of claim 1, wherein determining the candidate IP address block comprises determining a candidate multi-user IP address block.

3. The method of claim 2, wherein determining the candidate multi-user IP address block comprises at least one of:

identifying a consecutive IP address block that belongs to the same autonomous system having the same routing prefix entry;

comparing a block size of the IP address block with a predetermined minimum size; and

comparing a number of gaps in the IP address block with a predetermined maximum number of gaps.

4. The method of claim 1, further comprising receiving a dataset comprising a plurality of IP addresses representing at least one of a host activity or a user activity, wherein determining the candidate IP address block comprises analyzing the dataset.

5. The method of claim 4, wherein the dataset comprises a user login trace and IP address aggregation information.

6. The method of claim 1, wherein determining a usage entropy for each IP address in the candidate IP address block comprises:

constructing a binary user-IP address matrix for the candidate IP address block;

determining a submatrix of the binary user-IP address matrix that comprises a plurality of rows of the matrix that correspond to a plurality of users that have used a given IP address; and

computing the usage entropy for each IP address based on the submatrix.

7. The method of claim 1, wherein identifying the dynamic IP address block from the candidate IP address block based on the determined usage entropies comprises representing the usage entropies of IP addresses as discrete signal curves across the IP address space.

8. The method of claim 1, further comprising performing dynamics analysis on the identified dynamic IP address block.

9. The method of claim 8, wherein performing dynamics analysis comprises:

identifying IP address blocks that are misclassified as dynamic IP address blocks;

removing the misclassified IP address blocks from the dynamic IP address blocks; and

outputting a list comprising the dynamic IP address blocks, and volatility information for each dynamic IP address.

10. The method of claim 9, further comprising using IP volatility information to filter a plurality of IP addresses, and outputting a list of the filtered IP addresses as proxy clusters.

11. The method of claim 1, further comprising using the identified dynamic IP address block and proxy clusters in email filtering, phishing site detection, or web crawling.

12. A method of identifying dynamic Internet protocol (IP) addresses, comprising:

receiving a dataset comprising a plurality of IP addresses;

processing the dataset to determine a dynamically used IP address range comprising a plurality of dynamically used IP addresses; and

outputting the dynamically used IP address range.

13. The method of claim 12, wherein the dynamically used IP addresses are contiguous and are contained within a network boundary.

14. The method of claim 12, further comprising blocking the dynamically used IP addresses from sending mail to prevent spam.

15. The method of claim 12, wherein processing the dataset comprises:

determining multi-user candidate IP address blocks comprising at least a portion of the plurality of IP addresses;

determining a usage entropy for each IP address in each multi-user candidate IP address block; and

determining the dynamically used IP address range based on the determined usage entropies.

16. A dynamic Internet protocol (IP) address identification system, comprising:

an identifier that determines at least one candidate IP address block from an input dataset; and

a calculator that determines a usage entropy for each IP address in each candidate IP address block.

17. The system of claim 16, wherein the identifier identifies at least one dynamic IP address block from the at least one candidate IP address block based on the determined usage entropies.

18. The system of claim 17, further comprising an analyzer that performs dynamics analysis on the identified dynamic IP address blocks.

19. The system of claim 17, further comprising an output device that provides the at least one identified dynamic IP address block to at least one host for filtering of IP addresses.

20. The system of claim 16, wherein the input dataset comprises at least one user login trace with a plurality of IP addresses and at least one routing table.