| 摘要 |
An intermediary network device, such as a router or other device through which network traffic passes or which may monitor passing network traffic, looks for suspicious network activity by a device. If a suspicious device is identified, then the suspicious device, assuming it supports management, may be managed to wholly or partially disable the device until its suspicious activity may be investigated. Assuming the intermediary passes network traffic for the suspicious device, in addition to or in lieu of management, the intermediary may be configured to wholly or to partially block communication to/from the suspicious device. Suspicious network activity may be identified through attempts to access network addresses not present in a routing table associated with the intermediary. Other indicia of suspicious activity are disclosed.
|
