Predicting Zero-day Malicious IP Addresses Levering Threat Intelligence

URL blacklisting has been widely used for tackling Phishing, Malware, or Scamming attacks. However, Blacklists are not perfect and may not provide further information to intervene for the law-enforcement agencies. Our proposed framework quantify the likelihood of website maliciousness in a blacklist to identify truly malicious websites versus compromised ones, which also include confidence measures and explanations for model decisions. The confidence measure and explanations can work as a trustworthy basis for cyber defenders' domain-level intervention (e.g., domain take-downs).

Remarks:

I am the lead on this project as this work is towards my dissertation theme. Dr. Xu is advising me on the project with his expertise in cybersecurity research and validating research questions. The project is still ongoing, but early results show that this trustworthy quantification mechanism can play a vital role in enabling humans in the loop for AI-enabled security systems and reducing false positives from detections.