210 results about "Blacklisting" patented technology

A content filtering mechanism is enhanced to resolve conflicts in filtering rules (e.g., those created by a whitelist, on the one hand, and a blacklist, on the other hand). Preferably, a conflict between or among content filtering rules is resolved by selecting among conflicting rules based on a notion of “risk” associated with the rules. According to this risk-based approach, when two or more rules conflict with one another, the particular rule whose risk value has a predetermined relationship (e.g., aligns most closely) with a risk level associated with the application (applying the rules) then takes precedence. By selecting among conflicting rules based on risk, the potential or actual conflicts are disambiguated, with the result being that the content is filtered appropriately.

A method is provided for determining a rating of a likelihood of a victim system receiving malicious traffic from an attacker system at a point in time. The method comprises: generating a first forecast from a time series model based on past history of attacks by the attacker system; generating a second forecast from a victim neighborhood model based on similarity between the victim system and peer victim systems; generating a third forecast from a joint attacker-victim neighborhood model based on correlation between a group of attacker systems including the attacker system and a group of victim systems including the victim system; and determining the rating of the likelihood of the victim system receiving malicious traffic from the attacker system at the point in time based on the first forecast, the second forecast, and the third forecast.

There is proposed a mechanism for controlling a communication connection establishment to a subscriber using service including blacklisting, whitelisting, authentication request and/or Turing test for unsolicited communications prevention. Furthermore, there is proposed a management system used to configure a corresponding communication connection establishment control on the basis of an interface for the subscriber for defining a personalized communication connection establishment control profile.

The invention provides a crank call interception method and device. The crank call interception method comprises the following steps: acquiring a calling number which is calling at present and the ringing time of the calling number after the crank call interception mode of a communication terminal is started; if the ringing time of the calling number is smaller than a first preset threshold and the calling number is not a number of the number directory of the communication terminal, directly intercepting the calling number; if the ringing time of the calling number is larger than or equal to the first preset threshold and the calling number is not a number of the number directory of the communication terminal, prolonging the ringing time of the calling number, uploading the calling number to a cloud server, and directly intercepting the calling number when the cloud server confirms that the calling number is a crank call. Compared with a method that crank call numbers are manually added into call firewalls or blacklists, the crank call interception method is relatively accurate in identifying crank calls, and a user is effectively prevented from harassment of malicious crank calls.

The invention relates to the technical field of loan risk prevention and control system, in particular to a group fraud identification system based on a knowledge map, which includes an information collection module, an abnormality analysis module, an association analysis module, a group identification module, a display module, a display setting module and a survey and digging module. The information collection module is used for collecting personal information of the borrower. The abnormality analysis module is used for detecting and analyzing abnormal behavior or abnormal data of the borrower, and the association analysis module is used for analyzing the association relationship between the suspected fraudulent user and other borrowers or third-party blacklisted persons. The group identification module is used for finding other suspected fraudulent users related to the suspected fraudulent users according to the association relationship and forming a suspected fraudulent group for the case investigator to judge. The invention provides a group fraud identification system based on a knowledge map, which can identify and evaluate the groups among borrowers, find out the groups thatmay have fraud risk, and reduce unnecessary losses of banks.

The invention provides a method and a device for safety detection of universal resource locators. The method and the device solve the safety problem still remaining in user internet access caused by existing detection methods. After obtained, a universal resource locator is analyzed, and malicious websites can be detected according to a backlist of a first list, and a dangerous prompt is transmitted. As for credible websites in a white list of the first list, subdomain names such as forums and blogs editable to a user under domain names of the credible websites can have safety problems such as phishing by means of some special processing technologies so as to be incredible. Therefore, suspicious subdomain names and credible subdomain names in the credible websites can be detected by the aid of a second list, and the suspicious subdomain names refer to incredible subdomain names, so that the malicious websites and suspicious subdomain names can be guaranteed to be detected by the method and the device, and internet access safety is improved for the user.

The invention relates to the field of Internet security, and aims to provide a method for intelligently intercepting a threat IP based on cloud protection. The method for intelligently intercepting athreat IP based on cloud protection comprises the steps that: after receiving a cloud protection log, a big data log analysis server performs analysis according to a preset analysis rule, and stores the analyzed field information to an hbase cluster; a machine learning cluster establishes an analytic statistics model, the analytic statistics model can identify the behavior characteristics of an IPafter training, the machine learning cluster pushes the threat IP and corresponding domain name information to a cloud protection platform engine in real time, and the cloud protection platform engine dynamically adds the threat IP and the corresponding domain name information to a blacklist after receiving and implements corresponding interruption based on the attack threat level. The IP blacklist has high real-time property, and the configuration can be dynamically added and changed according to the log analysis result to effectively reduce the problem that the rule is bypassed and falselyreported.

The present invention provides a risk scoring model construction method. The construction method includes the following steps that: a blacklist sample library and a whitelist sample library are constructed according to preset account data, wherein the blacklist sample library includes abnormal accounts, and the whitelist sample library includes normal accounts; cluster training is performed on theabnormal accounts in the blacklist sample library and the normal accounts in the whitelist sample library on the basis of a gradient boosting decision tree (GBDT) algorithm, and abnormal account classification features are screened out; the abnormal account classification features are trained on the basis of a random forest (RF) algorithm, and a contribution degree corresponding to each abnormalaccount classification feature is obtained; and a risk scoring model is constructed according to the abnormal account classification features and the contribution degrees corresponding to the abnormalaccount classification features, and the risk scoring model is used for identifying the abnormal accounts. The risk scoring model constructed by the method of the invention improves the timeliness ofclearing the abnormal accounts, reduces noise interferences caused by the abnormal accounts, and improves the calculation precision of many indicators of APPs.

The invention provides a method for preventing an HttpFlood attack. The method includes the steps that a firewall generates and maintains a challenge list; the firewall establishes TCP connection with a user and judges whether a source IP address of a get message received from the user exist in the challenge list; if the source IP address of the get message received by the firewall does not exist in the challenge list, the firewall intercepts the get message and establishes a JavaScript redirection page according to the get message and adds the source IP address of the get message, the address of a get request page and the generated address of the generated JavaScript redirection page into the challenge list; when the firewall detects that an entry in the challenge list does not have a redirection access in a preset duration, the firewall adds the source IP address of the entry into a blacklist so as to prevent the subsequent traffic of the source IP address. The invention further provides the firewall for preventing the HttpFlood attack. Through the method, the firewall will not make a misjudgment, so the judgment accuracy rate is high.

The invention provides a method for filtering litter messages and a device thereof. The method comprises: a litter message sending party number blacklist is acquired from a server; the blacklist comprises the telephone number complained by a user terminal in the server user group; the litter message is filtered based on the telephone number of the acquired blacklist. By adopting the embodiment of the invention, the blacklist is generated based on the complaint of the user terminal in the user group, thus improving the success ration of litter message filtration.

The invention discloses a method for preventing crank calls, including the following steps of: judging a calling number is within a blacklist, if yes, judging to be a crank call, and starting blacklist automatic response; if no, further judging whether the calling number is within a white list or owner call records, if yes, starting owner response; if no, connecting a cloud public database, judging whether the calling number is a crank call which is labeled in the cloud public database, if yes, judging to be the crank call, and starting blacklist automatic response; if no, allowing the owner to judge whether the calling number is the crank call, if yes, directly hanging up, and entering calling number management; if no, starting owner response. Compared with the mode in the prior art that the crank calls are rejected, the method is opposite and adopts an automatic answer mode, which not only consumes the time and expense of callers, and also spiritually combats the enthusiasm of the callers, so that the calling targets of the callers cannot be achieved, and the crank calls can be effectively prevented.

Automated locating and disconnection of undesired devices may include receiving a unique address of a candidate device, determining the address of the switch coupled to the candidate device based on the address of the candidate device, accessing the switch using the switch address, receiving switch information from the switch, receiving credentials from the user and commands to transform the candidate device into a disconnected state, and determining whether the user is permitted to execute the commands based on the credentials from the user. If it is determined that the user is permitted to execute the commands, the candidate device may be transformed into a disconnected state on the network and its address may be added to a blacklist. A device may be deemed to be undesired on the network due to intrusion events, violation of network policies, or other appropriate criteria.

Modifying network connection policies of a wireless device based on user activity levels. One or more activity indicators of the wireless device may be monitored. One or more criteria for wireless network blacklisting may be selected based on the one or more activity indicators. The criteria may include different types of connectivity problems. A wireless network may be detected. The wireless network may be monitored for connectivity problems. The wireless network may be blacklisted if connectivity problems meeting the selected criteria for wireless network blacklisting are determined to have occurred.

The invention relates to the field of block storage areas, in particular to a blacklist sharing method and device, a computer device and a storage medium. The method comprises: obtaining a blacklist obtaining request sent by a query terminal, the blacklist obtaining request carrying a query identifier, and verifying the access permission of the query terminal according to the query identifier; obtaining a first encrypted blacklist corresponding to the blacklist obtaining request from a block chain storing the blacklist when the access permission of the query terminal passes verification; identifying uploading party information corresponding to the first encryption blacklist, generating an authorization verification request according to the uploading party information, and sending the authorization verification request to a query terminal; receiving an authorization certificate returned by the query terminal according to the authorization verification request, and decrypting the obtained first encryption blacklist according to the authorization certificate to obtain a query blacklist; and sending the query blacklist to a query terminal. By adopting the method, safe circulation of blacklist data among multiple enterprises can be effectively realized.

A system for collecting, maintaining, and distributing information and preferences of workers regarding whether and how they wish to be contacted by professional recruiters (or “headhunters”). Such a system involves the workers entering identifying information (e.g., name, profession, phone number, address, etc.) and their preferences though an Internet website, email, telephone, mail, or by other method. The information is then collected into a database or pair of databases—a “whitelist” of people who wish to be contacted by professional recruiters, and a “blacklist” of people who do not wish to be contacted by recruiters. The blacklist could either be sold or distributed for free to headhunters who operate in the worker's geographic area, with instruction to the headhunter not to contact the individuals on the list. The whitelist could be sold to those same headhunters as a listing of individuals who may be interested in using the headhunters' services.

The invention discloses a method and system for detecting phishing pages, a client side and a server. The method comprises the following steps: detecting an access request of a user on a payment page; after the access request of the user on the payment page is detected, inquiring the URL (Uniform Resource Locator) of first several levels of pages linked to the payment page; reporting the URL of the first several levels of pages to the server to cause the server to inquire a blacklist and/or a white list and a gray list stored by the server according to the URL of the first several levels of pages to obtain a query result; if the query result shows that the first several levels of pages contain the phishing pages or unknown suspicious pages, popping up a hint window. Under the condition that a phishing website is not determined, the scheme can also judge the phishing behaviors aiming at the network behavior characteristics. The scheme effectively makes prompts in real time when the user accesses the payment page, realizes the real-time interception for the phishing website, and protects the web browsing safety of the user.

The invention relates to the field of wireless communication and discloses a method and device for determining members of a blacklist. The method comprises the steps that when UE and a servicing cell are in an RRC connection state, whether adjacent cells of the servicing cell meet the current access requirements of the UE is judged; when the adjacent cells do not meet the current access requirements of the UE, the adjacent cells are determined to be the members of the blacklist of the UE. Through the method, the members of the blacklist can be determined so that configuration on the blacklist can be achieved; when the UE measures the adjacent cells to complete switching of the adjacent cells, the number of the measured adjacent cells is reduced, and the measurement accuracy of the adjacent cells which are possibly switched and used is improved; when measurement results are reported, the number of measurement reports of the adjacent cells in the blacklist is decreased, so that the load of bandwidth on the network side is reduced; the UE can better enable service to be conducted normally in the pilot frequency measurement process.