BOT-INFECTED HOST DETECTION APPARATUS AND METHOD BASED ON BLACKLIST ACCESS STATISTICS

摘要

PURPOSE: A bot-infected host detection device and method based on blacklist access statistics is provided to conveniently detect host which are infected to the bot from an inner network by using a new method without being changed by communication encoding and communication pattern reading. CONSTITUTION: A blacklist access statistic unit(223) calculates an access statistic about a blacklist per an inner IP address by using the access information and predetermine backlist information. A host state monitoring unit(225) monitors the state of the internal hosts which are connected to inside network by using access statistics. The host state monitoring unit detects an infected host. A database stores the access information, the blacklist information, and the status information for internal hosts and access statistics.