disclosed. Each blacklist comprises IP addresses of supposedly infected computers. The
reliability is com puted by analyzing whether the blacklist reports or not con trolled infections
from sandboxed environments and by mea Suring the elapsed time between reported
infections and disinfections. The obtained information is then used in com bination with
several metrics for determining the trustworthi ness of the IP address of a given Internet host …