Network entity characterization and attack prediction
  The devastating effects of cyber-attacks, highlight the need for novel attack
detection and prevention techniques. Over the last years, considerable work has
been done in the areas of attack detection as well as in collaborative defense.
However, an analysis of the state of the art suggests that many challenges
exist in prioritizing alert data and in studying the relation between a
recently discovered attack and the probability of it occurring again. In this
article, we propose a system that is intended for characterizing network
entities and the likelihood that they will behave maliciously in the future.
Our system, namely Network Entity Reputation Database System (NERDS), takes
into account all the available information regarding a network entity (e. g. IP
address) to calculate the probability that it will act maliciously. The latter
part is achieved via the utilization of machine learning. Our experimental
results show that it is indeed possible to precisely estimate the probability
of future attacks from each entity using information about its previous
malicious behavior and other characteristics. Ranking the entities by this
probability has practical applications in alert prioritization, assembly of
highly effective blacklists of a limited length and other use cases.
