Patent ID: 9374382
Filing Date: 2016-06-21
CPC Classification: H04L

Claim Text:
1. An apparatus for an attack source traceback, comprising: a server information extracting unit configured to detect an attack for a system, which is generated via a server to thereby extract information on the server; a traceback agent installing unit configured to install a traceback agent in a command and control server based on the information on the server; and a traceback unit configured to find an attack source for the system by analyzing network information of the server obtained by the traceback agent, and to sequentially install the traceback agent from a closest server to the system among a plurality of servers in case of an attack for the system which is generated via the plurality of servers, wherein the traceback agent installing unit installs the traceback agent in the command and control server and hides an execution result of the traceback agent so that an attacker does not perceive the installation of the traceback agent.