| 摘要 |
<p>A method for operating a security device according to an embodiment of the present invention comprises the steps of: classifying a plurality of IPs detected form a network according to a plurality of nations; detecting an attack attempted from each IP; determining whether the number of IPs from which attacks have been detected among the IPs for each nation is equal to or larger than a specified number; and decreasing, if there exists a nation from which at least the specified number of attack-detected IPs has been detected, a threshold value set for detecting attacks in relation to the IPs of the nation.</p> |
