APPARATUS, METHOD, AND NON-TRANSITORY COMPUTER-READABLE STORAGE MEDIUM FOR ATTACKING NODE DETECTION

An attacking node detection apparatus, method, and computer program product thereof are provided. The attacking node detection apparatus is configured to store a plurality of access records of an application, wherein each access record includes a network address of a host and an access content. The attacking node detection apparatus is configured to filter the access records into a plurality of filtered access records according to a predetermined rule so that the access content of each filtered access record conforms to the predetermined rule. The attacking node detection apparatus is configured to create at least one access relation of each of the network addresses according to the filtered access records, wherein each access relation is defined by one of the network addresses and one of the access contents. The attacking node detection apparatus is configured to identify a specific network address as an attacking node according to the access relations.