Bad neighborhoods on the internet

Giovane Moreira Moura, R. Sadre, Aiko Pras

    Research output: Contribution to journalArticleAcademicpeer-review

    9 Citations (Scopus)
    2 Downloads (Pure)


    Analogous to the real world, sources of malicious activities on the Internet tend to be concentrated in certain networks instead of being evenly distributed. In this article we formally define and frame such areas as Internet Bad Neighborhoods. By extending the reputation of malicious IP addresses to their neighbors, the bad neighborhood approach ultimately enables attack prediction from unforeseen addresses. We investigate spam and phishing bad neighborhoods, and show how their underlying business models, counter-intuitively, influences the location of the neighborhoods (both geographically and in the IP addressing space). We also show how bad neighborhoods are highly concentrated at a few Internet Service Providers and discuss how our findings can be employed to improve current network and spam filters and incentivize botnet mitigation initiatives.
    Original languageUndefined
    Pages (from-to)132-139
    Number of pages8
    JournalIEEE communications magazine
    Issue number7
    Publication statusPublished - Jul 2014


    • EWI-25862
    • IR-95242
    • METIS-310011

    Cite this