Abstract: The present disclosure provides a method for finding a hidden IP address in a malicious site using a domain name system (DNS) service, which is executed by a computer. The method includes the operations of: collecting real IP addresses for servers based on a predefined service port; extracting a first IP address candidate group by performing banner filtering from the real IP addresses based on response information of a malicious site using a DNS service; extracting a second IP address candidate group by performing HTML filtering to verify whether the first IP address candidate group is similar to a HTML source of the malicious site; extracting a final IP address by performing image filtering to verify whether the second IP address candidate group is similar to an image of the malicious site; and determining whether the final IP address is a real IP address of the malicious site.

Abstract: The present disclosure provides a method for finding a hidden IP address in a malicious site using a domain name system (DNS) service, which is executed by a computer. The method includes the operations of: collecting real IP addresses for servers based on a predefined service port; extracting a first IP address candidate group by performing banner filtering from the real IP addresses based on response information of a malicious site using a DNS service; extracting a second IP address candidate group by performing HTML filtering to verify whether the first IP address candidate group is similar to a HTML source of the malicious site; extracting a final IP address by performing image filtering to verify whether the second IP address candidate group is similar to an image of the malicious site; and determining whether the final IP address is a real IP address of the malicious site.

Abstract: Provided are an electronic device for deriving a domain connected to the IP address based on Open Source INTelligence (OSINT) information and for deriving the domain connected to the IP address based on an artificial intelligence (AI) model. and a method for the same.

Abstract: The present disclosure relates to an IP-based security control method and a system thereof. According to the present disclosure, the method comprises: selecting a target IP address that is an IP address of a security control target; generating IP monitoring information by scanning a port of the target IP address; determining an IP risk level of the target IP address by using the IP monitoring information; and generating a security report including at least one of an IP list determined by a preset IP risk level and IP monitoring information of an IP included in the IP list, wherein the IP monitoring information includes at least one of an IP address of the target IP address, banner information, application information, security vulnerability information, a malicious code, and a similar domain.

Abstract: The present disclosure provides a method for finding a hidden IP address in a malicious site using a domain name system (DNS) service, which is executed by a computer. The method includes the operations of: collecting real IP addresses for servers based on a predefined service port; extracting a first IP address candidate group by performing banner filtering from the real IP addresses based on response information of a malicious site using a DNS service; extracting a second IP address candidate group by performing HTML filtering to verify whether the first IP address candidate group is similar to a HTML source of the malicious site; extracting a final IP address by performing image filtering to verify whether the second IP address candidate group is similar to an image of the malicious site; and determining whether the final IP address is a real IP address of the malicious site.

Abstract: Disclosed is a malicious domain name system (DNS) server detecting method performed by a server detection device including transmitting at least one domain address thus pre-verified to at least one DNS server candidate, receiving at least one IP address associated with the transmitted at least one domain address from the at least one DNS server candidate, determining at least one verification target DNS server based on the received at least one IP address, and determining a malicious DNS server among the at least one verification target DNS server by comparing at least one normal IP address with the received at least one IP address.

Abstract: The present disclosure relates to an IP-based security control method and a system thereof. According to the present disclosure, the method comprises: selecting a target IP address that is an IP address of a security control target; generating IP monitoring information by scanning a port of the target IP address; determining an IP risk level of the target IP address by using the IP monitoring information; and generating a security report including at least one of an IP list determined by a preset IP risk level and IP monitoring information of an IP included in the IP list, wherein the IP monitoring information includes at least one of an IP address of the target IP address, banner information, application information, security vulnerability information, a malicious code, and a similar domain.

Abstract: The present disclosure provides a private server detection method through a computer, the method comprising: checking a banner in a database; determining whether a keyword is included in the banner; accessing a web page corresponding to the banner when the keyword is included; determining whether an operating server of the web page is a private server, based on a meta tag of the web page; generating information related to the operating server by crawling the web page when the operating server is a private server; and adding the generated information to the database, wherein the web page corresponds to an IP address and a port number from which the banner is obtained.