Patent ID: 8706866
Filing Date: 2014-04-22
Classification: G06F,H04L

Abstract:
1. A virtual server for identifying a zombie, the virtual server executed by at least one computer processor and comprising: a cookie checking module loaded on said at least one computer processor configured to check whether a cookie is present in a web server access request message received from a host; an authentication processing module loaded on said at least one computer processor configured to authenticate the host using a completely automated public Turing test to tell computers and humans apart (CAPTCHA) test and provide a cookie to the authenticated host when the web server access request message received from the host does not include a cookie; a defense mechanism trigger module loaded on said at least one computer processor configured to trigger a defense mechanism (a cookie value verification, a web page inducement, a zombie identification) when a current traffic statistics value (TCP SYN packet count, UDP packet count, ICMP packet count) is greater than a predefined threshold value and bypass a request traffic to the web server when the current traffic statistics value is less than the threshold value; a CAPTCHA generation module loaded on said at least one computer processor configured to generate a different CAPTCHA value whenever the host requests to access; a cookie value verification module loaded on said at least one computer processor configured to extract a cookie value from the web server access request message and verify the extracted cookie value when the web server access request message includes a cookie; a web page access inducement module loaded on said at least one computer processor configured to induce the host to access a web server when the cookie value is verified; and a zombie identification module loaded on said at least one computer processor configured to block access of the host when the cookie value is not verified, and identify the host as a zombie when a number of blocking operations exceeds a threshold value, wherein when the host does not submit a correct answer to the CAPTCHA test, the authentication processing module provides as many opportunities to submit the correct answer as a threshold value, and wherein when the host does not submit the correct answer in the as many opportunities as the threshold value, the authentication processing module identifies the host as a zombie, blocks access of the host, and transfers an access request message or an Internet protocol (IP) address of the host to a sinkhole server.