Zeroing Down on Moving IP Targets: Why Traditional Threat Intelligence is Failing — and What Comes Next

The Illusion of IP-Based Security

For decades, cybersecurity teams have treated IP addresses as the backbone of threat intelligence.

1. IP = identity

2. Reputation = risk

3. Blacklist = protection
   

This model worked in a simpler internet era. But today, it is fundamentally broken.

Modern infrastructure has changed the meaning of an IP address. A single IP can represent thousands of users through carrier-grade NAT (CGNAT), while a single attacker can rotate across hundreds of IPs using VPNs, mobile networks, or cloud infrastructure. The result is a system where identity is fluid, attribution is lost, and attackers operate in plain sight.

As outlined in our patent, traditional systems operate unidirectionally — analyzing IPs in isolation without associating them to broader entity behavior . This creates massive blind spots, especially in dynamic environments.

The Scale of the Problem: Why Detection is Failing

• CGNAT environments can map 10,000+ users to a single IP

• VPN providers rotate IPs across geographies within seconds

• Cloud instances allow attackers to spin up new identities instantly

• Mobile networks reassign IPs dynamically with session changes

Despite this, most systems still ask:

“Is this IP malicious?”

Instead of:

“What entities, behaviors, and infrastructure patterns are linked to this IP?”

This mismatch is the root cause of:

• False positives (blocking legitimate users)

• False negatives (missing actual attackers)

• Inability to track coordinated campaigns
  

The Shift: From Static Indicators to Dynamic Intelligence

• IP is no longer an identity

• Infrastructure is no longer stable

• Attackers are no longer linear

The only way forward is to treat IPs as signals within a larger behavioral graph.

At Com Olho, we redefined the approach:

IP addresses are infrastructure signals — not identifiers.

This shift allows us to move from:

• Static → contextual intelligence

• Isolated analysis → relational understanding

• Event-based detection → persistent attribution

  
  

Building Intelligence, Not Just Detection

• Multi-source telemetry ingestion

• Infrastructure-aware normalization

• Behavioral clustering

• Graph-based inference

  
  

Instead of analyzing logs as standalone events, the system constructs a multi-layer graph of relationships.

Each IP is contextualized based on:

• ASN and subnet proximity

• Mobile vs hosting vs VPN classification

• Reuse across accounts and sessions

These are not just metadata points — they become signals of intent and coordination.

As described in the system, IPs are grouped into infrastructure-based clusters, enabling analysis beyond surface-level reputation.

From Events to Behavior: The Power of Cohorts

• Temporal proximity

• Sequential IP movement

• Shared infrastructure usage

• Switching patterns (mobile ↔ VPN)

These signals are aggregated into session clusters and behavioral cohorts.

Instead of asking:

“What did this IP do?”

We ask:

“What pattern of behavior does this entity exhibit across infrastructure?”

This allows detection of:

• Multi-account fraud rings

• Bot-driven abuse

• Coordinated campaigns

Even when no single IP appears suspicious in isolation.

Enter Graph Neural Networks: Finding the Invisible

• Multi-hop relationship discovery

• Latent pattern detection

• Cross-entity inference

Traditional systems rely on deterministic rules. But attackers exploit the gaps between those rules.

Graph Neural Networks (GNNs) allow us to:

• Propagate signals across relationships

• Identify hidden connections

• Infer links that are not explicitly visible

This is critical in scenarios where:

• IP overlap is partial

• Infrastructure is shared

• Behavior is fragmented

The system performs multi-hop inference across IP nodes, session clusters, and entities, uncovering relationships that would otherwise remain invisible.

⚖️ From Signals to Certainty: Attribution Scoring

• IP rotation behavior

• Infrastructure clustering strength

• VPN/VPS overlay frequency

• Lack of network diversity

Each signal is assigned a weight and combined into a:

Continuous Attribution Confidence Score

This is not a binary decision — it is a probabilistic, explainable outcome.

In practical scenarios, the system achieves:

• High-confidence attribution scores (~0.9+)

• Ranked identification of primary and secondary actors

As shown in the architecture diagrams, weighted aggregation enables deterministic yet scalable attribution across millions of relationships .

Moving from Detection to Attribution

• Identify primary threat actor

• Discover linked (mule) accounts

• Map full infrastructure footprint

This is the biggest shift.

Most tools stop at detection:

“Something is wrong.”

This system goes further:

“This is the actor, these are their linked identities, and this is how they operate.”

Even if:

• IPs change

• Sessions rotate

• Infrastructure shifts

Attribution persists.

Real-Time Intelligence at Scale

• Millions of IP-entity relationships

• Sub-second query performance

• Continuous graph updates

The system is built for scale, ensuring that intelligence is not just deep — but also fast.

As new telemetry is ingested:

• Graphs update dynamically

• Feature activations recalibrate

• Attribution scores evolve

This enables real-time tracking of moving targets, a capability missing in traditional systems .

Why Explainability Matters

• Deterministic aggregation

• Transparent feature weighting

• Auditable decision paths

In enterprise and regulated environments, black-box AI is not enough.

Every decision must answer:

• Why was this flagged?

• What signals contributed?

• How confident is the system?

This architecture ensures:

Explainable AI meets operational security

The Bigger Picture: A Paradigm Shift

• From IP → Identity graphs

• From detection → attribution

• From static → adaptive intelligence

We are entering a phase where attackers:

• Use AI

• Rotate infrastructure instantly

• Operate across distributed systems

Defenders cannot rely on static indicators anymore.

Final Thought

The question is no longer:

“Is this IP malicious?”

The real question is:

“Who is behind this behavior — and how are they operating across the network?”

That is the future of threat intelligence.

And that is exactly what we are building at Com Olho.