Patent ID: 11882137
Assignee: AVAST SOFTWARE S.R.O.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 15:
16. A computerized network security honeypot system, comprising:
hardware comprising a processor, a memory, a nonvolatile machine-readable storage medium, and a network interface; and
a network attack monitoring module comprising instructions stored on the nonvolatile machine readable medium that when executed on the processor are operable to cause the computerized network honeypot system to collect activity data related to network attacks on the honeypot,
the activity data comprising a score indicative of a likelihood of future attacks from the same network address including network address of attacks and time of attacks, the network attack monitoring module operable to report the collected activity data to a blacklist creation module operable to analyze the activity data to generate a blacklist including network addresses predicted likely to be a source of a future attack based on the score being greater than a threshold value, and wherein each past threat os iteratively reassessed over time and the score indicative of a predicted likelihood of future attacl is undated to reduce a size of maintaining the generated network address blacklist by removing the network addresses from the blacklist that had no recent honeypot attack activity based on the generated score.