Reputation Block Lists (RBLs) serve as a common defense mechanism against harmful and unwanted Internet content. These lists contain the Internet Protocol (IP) addresses, domain names, or full Uniform Resource Locators (URLs) of known spam sources, phishing pages, malicious sites, or other unwanted content. By using RBLs to block incoming or outgoing access, Internet service providers, email providers, and other organizations can offer some level of protection for their users from online threats. They are also used for academic research and as training sets for machine learning models.
To help evaluate and understand the characteristics of RBLs, this document covers a set of metrics that can be used to help evaluate them both in isolation and in combination with other sources. These metrics, used within the Office of the Chief Technology Officer (OCTO) of the Internet Corporation for Assigned Names and Numbers organization (ICANN org), include RBL focus, mechanics, metadata, volume, overlap, timeliness, and churn. We categorize the metrics into four groups: a general description; metrics that can be directly measured; metrics that can be indirectly measured; and metrics that can only be discovered secondhand. We also show the structure we use to store different RBLs in a consistent manner, which simplifies the process of comparing RBLs and using them as a single data source.
read more | download PDF
To help evaluate and understand the characteristics of RBLs, this document covers a set of metrics that can be used to help evaluate them both in isolation and in combination with other sources. These metrics, used within the Office of the Chief Technology Officer (OCTO) of the Internet Corporation for Assigned Names and Numbers organization (ICANN org), include RBL focus, mechanics, metadata, volume, overlap, timeliness, and churn. We categorize the metrics into four groups: a general description; metrics that can be directly measured; metrics that can be indirectly measured; and metrics that can only be discovered secondhand. We also show the structure we use to store different RBLs in a consistent manner, which simplifies the process of comparing RBLs and using them as a single data source.
read more | download PDF
