stratosphereips/aip repository overview

The Attacker IP Prioritization (AIP) is a tool to generate efficient and economic IP blocklists based on network traffic captured from honeypot networks.

With the advent of 5G, IoT devices are directly connected often without firewall protection. Therefore we need blocklists that are small, efficient and economic. The AIP structure is shown below.

⁠AIP Models

Each AIP model generates its own blocklist based on a specific criteria. The main models are:

⁠Prioritize New (PN)

Focuses on IPs that are new or have not been seen frequently in previous data. Useful to identify emerging attackers that are starting to target a network.

⁠Prioritize Consistent (PC)

Focuses on IPs that have consistently attacked over time in previous data. Useful to identify persistent attackers that continuously target a network.

⁠Alpha

Provides a baseline identifying all attackers seen in the last 24 hours. Useful to compare the effectiveness of other models.

⁠Alpha7

Provides a baseline identifying all attackers seen in the last 7 days. Useful to further compare the effectiveness of other models.

⁠Random Forest

Focuses on IPs that are more likely to attack in the future. A more experimental approach to increase blocklist efficiency.