VIRTUAL SERVER AND METHOD FOR IDENTIFYING ZOMBIE, AND SINKHOLE SERVER AND METHOD FOR INTEGRATEDLY MANAGING ZOMBIE INFORMATION

• US 20110270969A1
• Filed: 01/06/2011
• Published: 11/03/2011
• Est. Priority Date: 04/28/2010
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Dong Soo, Yun, Young Tae, Chung, Yoon Jung, Han, Yu Jung, Lee, Cheol Won, Kim, Won Ho, Noh, Sang Kyun, Kim, Yo Sik
• Granted Patent: US 8,706,866 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

Provided are a virtual server and method for identifying a zombie, and a sinkhole server and method for integratedly managing zombie information. The virtual server includes an authentication processing module authenticating a host using a CAPTCHA test and providing a cookie to the authenticated host when a web server access request message received from the host does not include a cookie, a cookie value verification module for extracting a cookie value from the web server access request message and verifying the extracted cookie value when the web server access request message includes a cookie, a web page access inducement module for inducing the host to access a web server when the cookie value is verified, and a zombie identification module for blocking access of the host when the cookie value is not verified, and identifying the host as a zombie when the number of blocking operations exceeds a threshold value.

Claims

1. A virtual server for identifying a zombie, comprising:

an authentication processing module for authenticating a host using a completely automated public Turing test to tell computers and humans apart. (CAPTCHA) test and providing a cookie to the authenticated host when a web server access request message received from the host does not include a cookie;

a cookie value verification module for extracting a cookie value from the web server access request message and verifying the extracted cookie value when the web server access request message includes a cookie;

a web page access inducement module for inducing the host to access a web server when the cookie value is verified; and

a zombie identification module for blocking access of the host when the cookie value is not verified, and identifying the host as a zombie when a number of blocking operations exceeds a threshold value.

2. The virtual server of claim 1, further comprising a cookie database (DB) for storing a cookie value corresponding to an Internet protocol (IP) address of the host.

3. The virtual server of claim 1, wherein when the host does not submit a correct answer to the CAPTCHA test, the authentication processing module provides as many opportunities to submit the correct answer as a threshold value.

4. The virtual server of claim 3, wherein when the host does not submit the correct answer in the as many opportunities as the threshold value, the authentication processing module identifies the host as a zombie, blocks access of the host, and transfers an access request message or an Internet protocol (IP) address of the host to a sinkhole server.

5. The virtual server of claim 2. wherein the cookie value authentication module verifies the extracted cookie value by comparing the extracted cookie value and the cookie value stored in the cookie DB and corresponding to the IP address of the host.

6. The virtual server of claim 1, wherein the zombie identification module transfers a message received from the host identified as a zombie or an Internet protocol (IP) address of the host identified as a zombie to a sinkhole server.

7. A sinkhole server, comprising:

a duplicated Internet protocol (IP) removal module for collecting IP addresses of zombies provided by a virtual server, which is disposed at a front end of a web server and identifies a zombie attempting to access the web server, and removing a duplicated IP address from the IP addresses;

a zombie scale determination module for calculating a total number of the IP addresses except the duplicated IP address to determine a scale of zombies;

a geographical distribution recognition module for recognizing geographical distribution of the zombies using geographical information implied in the IP addresses; and

a zombie information database (1)3) for storing the determined scale of zombies and the geographical distribution.

8. The sinkhole server of claim 7. Further comprising an IP address extraction module for extracting the IP addresses of the zombies from zombie traffic when the zombie traffic is retransferred from the virtual server.

9. A method of identifying a zombie, comprising:

determining whether a web server access request message received from a host includes a cookie;

transmitting a completely automated public Turing test to tell computers and humans apart (CAPTCHA) page to the host when the access request message does not include a cookie;

transmitting a cookie corresponding to an Internet protocol (IP) address of the host when a correct answer to the CAPTCHA page is received from the host;

extracting a cookie value from the access request message and checking whether the extracted cookie value corresponds to the IP address of the host when the access request message includes a cookie; and

blocking access to a web server when the cookie value does not correspond to the IP address of the host, and identifying the host as a zombie when a number of blocking operations exceeds a threshold value.

10. The method of claim 9, further comprising repeatedly transmitting the CAPTCHA page to the host to provide as many opportunities to submit a correct answer as a threshold value when the correct answer to the CAPTCHA page is not received from the host, and

identifying the host as a zombie when a number of times that the host fails to submit the correct answer exceeds the threshold value.

11. The method of claim 9, further comprising retransferring an access request message received from the host identified as a zombie or the IP address of the host to a sinkhole server.

12. The method of claim 9, further comprising, when the cookie value corresponds to the IP address of the host, providing a web page of the web server to allow the host to access the web server.

13. A method of integratedly managing zombie information, comprising:

collecting Internet protocol (IP) addresses of zombies provided by a virtual server, which is disposed at a front end of a web server and identifies a zombie attempting to access the web server;

removing a duplicated IP address from the IP addresses;

calculating a total number of the IP addresses except the duplicated IP address to determine a scale of zombies; and

recognizing geographical distribution of the zombies using geographical information implied in the IP addresses.