Blocking malicious activity using blacklist
US8387145B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jun 8, 2009 |
| Grant date | Feb 26, 2013 |
| Priority date | — |
| Expiry date | Nov 20, 2031 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/144
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
An IP (Internet Protocol) address is a directly observable identifier of host network traffic in the Internet and a host's IP address can dynamically change. Analysis of traffic (e.g., network activity or application request) logs may be performed and a host tracking graph may be generated that shows hosts and their bindings to IP addresses over time. A host tracking graph may be used to determine host accountability. This can enable host-based blacklisting instead of the traditional IP address based blacklisting. Host tracking results can be leveraged for forensic analysis to understand an attacker's traces and identify malicious activities in a postmortem fashion. The host tracking information may be used to build a tracklist which can block future attacks.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.