Patent Document ID: 10097569
Application ID: 15273928
Patent Status: 1

Claim One:
1. A system for tracking a malware route and behavior in order to defend against cyberattacks, comprising: multiple hosts in which first event data concerning object behavior are collected and pieces of host-based event information are created using the first event data; a tracking information database server for storing the pieces of host-based event information therein; and a tracking information analysis server for creating behavior events by defining malware behavior from the pieces of host-based event information, for searching the pieces of host-based event information and the behavior events for a target to be analyzed based on a preset input value, for creating first tracking contexts, through which the malware behavior is capable of being identified, by analyzing a relationship between the pieces of host-based event information and a relationship between a set of the pieces of host-based event information and a set of the behavior events, which correspond to the target to be analyzed, and for creating second tracking contexts, through which a malware route and behavior events between the multiple hosts are capable of being tracked, by analyzing a correlation between the first tracking contexts, wherein the first tracking contexts are tracking contexts inside at least one of the multiple hosts, and the second tracking contexts are tracking contexts between the multiple hosts.