Patent ID: 8874723

Claim:
A source detection method for detecting a source of virus and/or a DNS attack, comprising: a step of storing virus information to a database; a step of capturing packets of a designated protocol, said packets being sent from a network; a step of gathering the captured packets on per application basis, performing processing related to an application which is associated with the received packets, said processing including at least detection of presence or absence of virus and/or DNS attack, in order to obtain information necessary for traceback related to the application; a step of converting format of the obtained information to format common among applications and storing the obtained information in the common format to a database; a step of performing the traceback related to the application, in order to locate a source which has attacked a target; a step of storing log information with respect to each application server which has run; a step of detecting presence or absence of linkage of applications, based on the virus information, the log information of each application server, a result of the traceback related to each application, and the information obtained from the captured packets, which are stored in the database; and a step of, if presence of linkage between a first application, with respect to which the traceback is performed, and a second application is detected, repeating a group of the step of capturing packets of another designated protocol which corresponds to the second application, the step of gathering, the step of converting, and the step of performing the traceback related to the second application.