Electronic device and method for detecting malicious server
AssigneeS2W Inc.
InventorsIn Wook HWANG, Chang Hoon Yoon
Life of this patent
Estimating the term…
Abstract
Provided are an electronic device and method for detecting a malicious server. The method includes acquiring first feature information of a server Internet protocol (IP) of a malicious website, acquiring second feature information of a server IP of a comparative website, comparing the first feature information with the second feature information, and determining that the malicious website has been changed to the comparative website on the basis of the comparison result.
Claims8
A method of detecting a malicious server by an electronic device, the method comprising:
- acquiring first feature information of a server Internet protocol (IP) of a malicious website;
- acquiring second feature information of a server IP of a comparative website from a response packet of the comparative website;
- comparing the first feature information with the second feature information;
- and
- determining that the malicious website has been changed to the comparative website on the basis of a comparison result,
- wherein the determining that the malicious website has been changed to the comparative website comprises:
- calculating similarities between same types of protocol information included in the first feature information and the second feature information;
- calculating an add-up similarity by giving weights to the calculated similarities according to the types of protocol information, wherein a smaller weight is given to protocol information that is more likely to be dropped in a process of transmitting the response packet to calculate the add-up similarity;
- and
- determining that the malicious website has been changed to the comparative website when the add-up similarity is larger than a predetermined value.
An electronic device for detecting a malicious server, the electronic device comprising a processor configured to acquire first feature information of a server Internet protocol (IP) of a malicious website, acquire second feature information of a server IP of a comparative website from a response packet of the comparative website, compare the first feature information with the second feature information, and determine that the malicious website has been changed to the comparative website on the basis of a comparison result,
- wherein the processor configured to calculate similarities between same types of protocol information included in the first feature information and the second feature information, calculate an add-up similarity by giving weights to the calculated similarities according to the types of protocol information, wherein a smaller weight is given to protocol information that is more likely to be dropped in the process of transmitting the response packet to calculate the add-up similarity, and determine that the malicious website has been changed to the comparative website when the add-up similarity is larger than a predetermined value.
Dependencies are inferred from the claim text.