A Robust Algorithm for Identifying Malicious IPs Enhancing Cybersecurity Defense

The rise in cyberattacks intended for enterprises has made the detection and classification of malicious IP addresses an essential aspect of cybersecurity. Manual IP reputation assessments are time-consuming and insufficient for high-velocity environments, such as Security Operations Centers (SOCs) in cybersecurity. This paper presents an automated, multi-source system for categorizing IPs as "good" or "bad." It implements APIs from AbuseIPDB and VirusTotal, integrating their threat intelligence ratings to offer real-time IP analysis. The system performs an analysis of user-submitted IP addresses, acquires threat data from two APIs, computes a weighted score, and categorizes each IP. Experimental evaluations demonstrate proper classification, facilitating quicker IP reputation tests compared to traditional static methods. This system enables analysts to concentrate on critical duties and enhance incident response times by providing SOCs with real-time, scalable IP classification. This system provides security analysts with a rapid and reliable instrument for threat detection and response.