Virtual server and method for identifying zombies and Sinkhole server and method for managing zombie information integrately based on the virtual server

摘要

The present invention has been infected by a malicious bot (bot) to perform malicious actions zombies (zombie) Host and a virtual server for performing this method and for identifying and blocking, to a method and sinkhole server to do this to determine the scale and distribution of zombies by analyzing zombie information obtained based on this virtual server. A virtual server according to the invention automatically prevents access to the web server if the access request message received from the host does not include the cookie (CAPTCHA) authenticating the host by using the test and certification process for providing a cookie to the authenticated host module; A cookie value verification module for extracting a cookie value from the web server access request message when the web server access request message including the cookie and verifying the extracted cookie value; A successful validation of the web page cookie value connected to the induction module for inducing the host to connect to the Web server; And if the failed verification of the value of the cookie comprises a zombie identification module for blocking access of the host to identify the case in which the number of blocks exceeds the threshold value the the host as a zombie. ;