Method and system for discovering malicious traffic-free servers
A discovery method and server technology, applied in transmission systems, accounting/billing services, electrical components, etc., can solve problems affecting operators' operating income, user information leakage, etc., and achieve the effect of reducing the risk of leakage
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0068] figure 1 For the flowchart of the discovery method of the malicious flow-free server provided by the embodiment of the present invention, please refer to figure 1 The method for discovering a malicious traffic-free server provided by an embodiment of the present invention includes the following steps:
[0069] S1, analyze the network behavior of each server in the whitelist database, and find out the suspected malicious traffic-free server.
[0070] Wherein, the so-called whitelist database refers to the list of servers that are set to avoid traffic in the operator's system. Specifically, the network behavior of each server is analyzed in an IDC (Internet Data Center, Internet Data Center) access database.
[0071] S2, extracting all source IP addresses accessing each suspected malicious traffic-free server.
[0072] Specifically, all source IP addresses of accessing each suspected malicious traffic-free server can be extracted from the access database of IDC (Intern...
Embodiment 2
[0109] Figure 4 It is a functional block diagram of the discovery system of the malicious flow-free server provided by the embodiment of the present invention. see Figure 4 The discovery system of the malicious flow-free server provided by the embodiment of the present invention includes: an analysis module 10, an extraction module 11, an acquisition module 12 and a query determination module 13. in
[0110] Analysis module 10 is used for analyzing the network behavior of each server in the white list database, finds out suspected malicious traffic-free server.
[0111] The extraction module 11 is used to extract all source IP addresses of accessing each suspected malicious traffic-free server.
[0112] The obtaining module 12 is used to obtain the intranet IP address matching each source IP address.
[0113] Inquiry determination module 13 is used to inquire about the corresponding mobile terminal number and the online record of each intranet IP address, and judges that...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More 


