| CPC H04L 63/101 (2013.01) [H04L 63/0236 (2013.01); H04L 63/108 (2013.01)] | 20 Claims |
|
1. At least one non-transitory computer-readable storage medium including instructions, which when executed by processing circuitry, causes the processing circuitry to perform operations to:
filter incoming internet traffic at a traffic control component, the traffic control component using a specific internet protocol (IP) filtering algorithm for filtering the incoming internet traffic;
output, from the traffic control component, a risk factor score for a particular IP address that was blocked by the traffic control component;
determine, at an IP curator, whether to add the particular IP address to a blocklist based on the risk factor score;
in response to a determination to add the particular IP address to the blocklist based on the risk factor score, generate, at the IP curator, an IP address entry in the blocklist for the particular IP address, the IP address entry including a corresponding time-based expiration, the corresponding time-based expiration determined based on historical data related to the particular IP address; and
output the IP address entry to a firewall in response to a request from the firewall, wherein a request from the particular IP address is blocked at the firewall, based on the corresponding time-based expiration in the IP address entry, before the request from the particular IP address reaches the traffic control component.
|