What Are Source Address Blacklists?
There are two common practices in formulating a blacklist. Sites such as DShield.org compile global worst offender lists (GWOL) of the most prolific attack sources, and regularly post firewall parsable filters of these lists to help the Internet community fight back. Another common practice is for a local network to create its own local worst offender list (LWOL) of those sites that have attacked it the most. LWOLs have the property of capturing repeat offenders that are indeed more likely to return to the local site in the future but are only reactive to new encounters with previously unseen attackers. On the other hand, while GWOL has the potential to inform a local network of highly prolific attackers, it also has the potential to provide a subscriber with a list of addresses that will simply never be encountered. Highly Predictive Blacklists (HPBs) represent a radically different approach to blacklist formulation. HPB are derived uniquely per DShield contributor, and rank the attac
