Patent ID: 7814546

Claim:
A system for determining the point of entry of a malicious packet into a network, comprising: an intrusion detection device configured to detect entry of the malicious packet into the network; a stepping stone detection device configured to detect stepping stones in extended connections within the network, identify correlated connection pairs according to the detected stepping stones, and produce a table of connection pairs based upon the identified correlated connection pairs; and a traceback engine responsive to operation of the intrusion detection device and configured to isolate the malicious packet, the traceback engine configured to: generate a query message containing identification information about the malicious packet; forward the query message to certain of a plurality of routers operatively connected to the traceback engine, the certain of the plurality of routers being configured to generate a representation of a plurality of packets as the packets are forwarded through the network and determine based on the representation whether the malicious packet has been transmitted through certain of the routers in response to the forwarded query message; and determine, using the established connection pair table, a previously received representative packet, the representative packet being from an incoming connection correlated with the connection including the malicious packet; and use the representative packet determined from the detected stepping stones to determine the point of entry of the malicious packet.