Patent ID: 8112804
Filing Date: 2012-02-07
Classification: H04L

Abstract:
1. A malicious BOT measures method comprising the steps of: detecting excessive Domain Name System (DNS) queries generated by compromised PC through malicious BOT; analyzing these queries to classify into normal or abnormal management target; and redirecting the abnormal DNS query registered as a management target to a redirection processing & response system, wherein the redirecting step includes the steps of: changing a destination address of the abnormal DNS query, into the redirection processing & response system; generating a response to the abnormal DNS query in the redirection processing & response system: and transmitting the response to the compromised PC by malicious BOT, wherein the response generated from the generating step has one of a loop-back address preset by a network administrator and an address of honey pot system for the intrusion temptation and the analysis of malicious BOT characteristics.