Patent Document ID: 20170374086
Application ID: 15273928
Patent Status: 0

Claim One:
1. A system for tracking a malware route and behavior in order to defend against cyberattacks, comprising: multiple hosts in which first event data concerning object behavior are collected and pieces of host-based event information are created using the first event data; a tracking information database server for storing the pieces of host-based event information therein; and a tracking information analysis server for creating behavior events by defining malware behavior from the pieces of host-based event information, for searching the pieces of host-based event information and the behavior events for a target to be analyzed based on a preset input value, for creating first tracking contexts, through which the malware behavior is capable of being identified, by analyzing a relationship between the pieces of host-based event information and a relationship between a set of the pieces of host-based event information and a set of the behavior events, which correspond to the target to be analyzed, and for creating second tracking contexts, through which a malware route and behavior events between the multiple hosts are capable of being tracked, by analyzing a correlation between the first tracking contexts.