Patent ID: 9621582
Date: 2017-04-11
CPC Classifications: H04L

Claim:
1. A method of alerting operators of Internet sites of potential pharming attacks, comprising: generating pharming alerts in response to detecting mismatches between a set of expected IP (Internet Protocol) addresses of an Internet site and a set of IP addresses for the Internet site obtained by querying multiple DNS (Directory Name System) servers on the Internet; filtering the generated pharming alerts based on a set of circumstances that surround the generated pharming alerts to produce a blocked set of pharming alerts and an allowed set of pharming alerts; and sending the allowed set of pharming alerts to an operator of the Internet site to warn the operator of potential pharming attacks, wherein filtering the generated pharming alerts includes, for a current pharming alert of the generated pharming alerts: wherein the method further comprises receiving input from the operator of the Internet site for establishing the threshold level based on a risk tolerance of the Internet site to pharming attacks, such that comparing the assigned severity level of the current pharming alert with the threshold level evaluates the current pharming alert based on the input received from the operator.