System and method for connection fingerprint generation and traceback based on netflow

Abstract

The present invention relates to a method for tracing a cyber hacking attack and, more particularly, to a system and a method for generating a connection fingerprint and tracing back a source site using a network flow. The method for connection fingerprint generation and traceback based on netflow comprises: a step of receiving a traceback request including IP packet attribute information of a victim and an attacker corresponding to a target connection, which is a final connection of a connection chain; a step of generating a fingerprint for a related connection based on the IP packet attribute information and requesting related information to a network flow collector; a step of detecting connection of a stepping stone for the target connection, which is made when the fingerprint is generated, to confirm whether a selected subject connection is present on the same chain as the target connection; and a step of determining a connection sequence with respect to an attacker host for the subject connection confirmed to be present on the same connection chain as the target connection.

Description

[0001] Cross References to Related Applications [0002] This application claims priority and benefit from Korean Patent Application No. 10-2015-0156952 filed on November 9, 2015 and Korean Patent Application No. 10-2016-0052154 filed on April 28, 2016, hereby incorporated by reference Merge all its disclosures. technical field [0003] The present invention relates to techniques for tracking network hacking attacks, and more particularly, to systems and methods for using Network Flow (NetFlow) data to generate fingerprints of connections and trace the origin of attacks. Background technique [0004] The technique used to trace a network hacking attack consists in locating the real location of the hacker, ie, the origin of the attack, even when the location of the attacking system is different from the real location of the hacker who actually tried to crack the system. [0005] As techniques for tracing network hacking attacks according to the prior art, host-based TCP conn...

AI Technical Summary

Problems solved by technology

[0012] In order to solve the problem of the prior art that requires a dedicated monitoring device and thus it is practically difficult to apply to the Internet environment, and detection is difficult in the case where IP spoofing or other methods are used to hide the attacker's information, the present invention provides A method of NetFlow-based connection fingerprint generation and stepping stone tracing is proposed. This method is not limited to the application in the existing Internet environment, minimizes the overhead, and can trace the origin of the attack by using the NetFlow information provided by the router.

Images