Discovery of suspect IP addresses

摘要

A method of discovering suspect IP addresses, the method including, at a client computer: monitoring the computer for malware; on detection of malware, obtaining a list of IP addresses with which a connection has been made or attempted at the client computer within a preceding time frame; sending the list of IP addresses to a central server; and receiving from the central server a blacklist of suspect IP addresses to allow the client computer to block connections with IP addresses within said blacklist.

主权项

1. A method of discovering suspect IP addresses, the method comprising:
at a client computer:
monitoring the client computer for malware;in response to detection of malware operating on the client computer, triggering the client computer to obtain a list of IP addresses, the IP addresses being IP addresses with which a connection has been made or attempted at the client computer within a preceding time frame;sending the list of IP addresses to a central server;receiving from the central server a blacklist of suspect IP addresses, wherein the blacklist of suspect IP addresses is based at least on the list of IP addresses; andblocking connections with IP addresses within said blacklist.