Patent ID: 9537887
Date: 2017-01-03
CPC Classifications: H04L

Claim:
1. A method for tracing back a network connection chain in a traceback system for a network attack, the method comprising: (A) searching, by one or more trace agents distributed on a network, a next network session including a trace address included in first finger printing information as a destination address by referring to a database, the first finger printing information in which a source address of a previous network session is substituted with the trace address; and (B) searching, by the respective trace agents, network flow information of the next network session, which includes the first finger printing information, by referring to the database to generate second finger printing information including a source address of the searched next network session as the trace address and generate an attack connection chain list including an ID for the searched next network session in addition to an ID for the previous network session, wherein finger printing information further includes a flow start time and a flow end time, wherein step (B) includes: wherein step (B) further includes generating a final attack connection chain list up to now and transmitting the generated final attack connection chain list to the trace requester on the network when the network flow information including the first finger printing information is not searched.