Rabin & Berdo, P.C.
Apparatus and method for attack source traceback
An apparatus and a method for an attack source traceback capable of tracing back an attacker, that is, an attack source present behind a command and control (C&C) server in a cyber target attack having non-connectivity over a transmission control protocol (TCP) connection are disclosed. The apparatus for the attack source traceback includes: a server information extracting unit detecting an attack for a system, which is generated via a server to thereby extract information on the server; a traceback agent installing unit installing a traceback agent in the server based on the information on the server; and a traceback unit finding an attack source for the system by analyzing network information of the server obtained by the traceback agent.
ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE
H H H
H04L H04L H04L
inventional inventional inventional
Min-Ho Ik-Kyun Hyun-Sook Jung-Tae
Han Kim Cho Kim