KR20130049336A - Method and system for tracking attack source and attack spreading site - Google Patents

Abstract

PURPOSE: A method for tracking attack sources and attack distribution places and a system thereof are provided to manage a path and configuration for an attack scenario by tracking an abnormal file uploader in real-time. CONSTITUTION: An agent(500) receives an information confirmation message of an abnormal file corresponding to the information transmission of an abnormal file(S117). The agent selects a place corresponding to the information of the abnormal file as an attack distribution place(S119). The agent transmits an abnormal file uploader information request message. The agent receives the abnormal file uploader information corresponding to the request message(S121). When the received abnormal file uploader information corresponds to the stored uploader information, the agent sets an attack source using the abnormal file uploader information(S123). [Reference numerals] (100) Attack computer; (200) User computer; (300) Network security server; (400) Site file management server; (500) Agent; (S101) Upload an abnormal file; (S103) Analyze action and extract uploader information; (S105) Transmit the uploader information; (S107) Store the uploader information; (S109) Download abnormal file; (S111) Store downloaded user information with the uploader information; (S113) Transmit attack information when detecting cyber attack; (S115) Transmit transmission network address; (S117) Transmit confirmation message of the transmission network address; (S119) Define an attack distribution place; (S121) Receive the uploader information; (S123) Define an attack source

Description

METHOD AND SYSTEM FOR TRACKING ATTACK SOURCE AND ATTACK SPREADING SITE}

The present invention relates to a method and a system for tracking an attack source and an attack distribution site, and more particularly, to a method and a system for tracking an attack source and an attack distribution site for preventing information leakage and personal information leakage of a social infrastructure.

Recently, due to the rapid development of the Internet, the Internet is expanding and its use is increasing at the base of social infrastructure and living. As the Internet expands to the infrastructure and the base of life, malicious attackers frequently leak information of the infrastructure and personal information.

Therefore, in order to prevent the leakage of information and personal information from the infrastructure, various methods of tracking the origin of attack and the distribution of attack have been proposed.However, conventionally proposed methods include a log analysis method, a sampling method, a static assembly source code scan (SAS) method, and the like. There was this.

First, the log analysis method is a passive method of identifying an attack path by repeatedly performing a log analysis process, which includes a risk of total network paralysis. In particular, when log information is deleted, not only the entire log analysis itself is impossible, but also the efficiency decreases as the amount of data increases in actual implementation.

Sampling technique XORs the edge information between routers in the fixed header field and marks it to reconstruct the attack path based on the information finally collected from the victim system, thereby reproducing the IP spoofing attack source. It can be traced back. However, the sampling technique is inefficient for traceback of attack origin when large-scale distributed denial of service (DDOS) attacks are performed, and it is difficult to completely trace the attack origin for packets transmitted without marking edge information or node information. There is a problem.

Static Assembly Source Code Scan (SASS) is a method of searching static assembly code. It consists of input search, summary DB, and output, and then accesses a new method including buffer overflow. Code search. However, the static assembly code search method has a problem that it is difficult to track in real time and takes a lot of time by acting as an interpreter in the emulator. In particular, there is a problem in that it is difficult to apply to tracking the source and distribution of the attack because the purpose is to search the target by tracking the flow in the source code.

An object of the present invention for solving the above problems is to provide an attack source and attack distribution site tracking method that can be tracked in real time.

It is another object of the present invention to provide an attack source and attack distribution site tracking system that can be tracked in real time.

According to the attack source and attack distribution site tracking method according to an embodiment of the present invention for achieving the above object, in the attack source and distribution site tracking method performed by the agent, in the attack source and distribution site tracking method performed by the agent, Transmitting the information of the abnormal file among the received information, and if an information confirmation message of the abnormal file is received in response to the information transmission of the abnormal file, defining a location corresponding to the information of the abnormal file as the attack distribution site. Transmitting the abnormal file uploader information request message and the abnormal file uploader information and the previously stored uploader information when the abnormal file uploader information is received in response to the request message. Compare the information and judge that the comparison result Surface, and a step which defines the attack source using the abnormal file upload character information.

In addition, according to the attack source and attack distribution site tracking system according to an embodiment of the present invention for achieving another object of the present invention, an attack for transmitting the information of the abnormal file of the information received through the agent communication unit and the agent communication unit When the information tracking message of the abnormal file is received in response to the distribution site tracking unit and the information transmission of the abnormal file through the communication unit, the location corresponding to the abnormal file information is defined as an attack distribution site and the prescribed attack distribution site information is provided. The attack distribution site tracking unit, the control unit for transmitting the abnormal file uploader information request message when the attack distribution site information is provided from the attack distribution site tracking unit, and the abnormal file uploader corresponding to the abnormal file uploader information request message of the control unit. If information is received, the received If it is determined that the result compared by comparing the uploading party information stored in advance and a normal file upload character information correspond, include tracking attack source portion, which defines the attack source using the abnormal file upload character information.

According to the attack source and attack distribution site tracking method and system according to an embodiment of the present invention as described above, the sender network address confirmation message is received by transmitting a sender network address confirmation request message that transmits an abnormal file to a file management server. In this case, the file management server may be defined as an attack distribution site, and if the uploader information corresponds to the pre-stored uploader information, the attack source may be defined using the uploader information, and the attack source information and the distribution site information may be transmitted to neighboring agents. .

Therefore, it is possible to track the abnormal file uploader in real time, and it is possible to manage the attack scenario configuration and path for the attack source and attack distribution site, and share the attack source and attack distribution site information in real time. In addition, by establishing a real-time system for threats of information and communication technology in the broadcasting communication convergence service environment, it is possible to improve the organic tracking of the improved form.

1 is a flowchart illustrating a method for tracking an attack source and an attack distribution site according to an embodiment of the present invention.
2 is a flowchart illustrating a procedure performed in a file management server of a site in an attack source and attack distribution site tracking method according to an embodiment of the present invention.
3 is a flowchart illustrating a procedure performed by an agent in the attack source and attack distribution site tracking method according to an embodiment of the present invention.
4 is a flowchart illustrating a method for tracking an attack source and an attack distribution site according to another embodiment of the present invention.
5 is a conceptual diagram of an attack source and attack distribution site tracking system according to an embodiment of the present invention.
Figure 6 is a block diagram showing the configuration of the file management server of the site of the attack source and attack distribution site tracking system according to an embodiment of the present invention.
7 is a block diagram showing the configuration of an agent in the attack source and attack distribution site tracking system according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the understanding of the present invention, the same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

In the method and system for tracking the attack source and attack distribution site according to an embodiment of the present invention, it is assumed that the abnormal file uploader disguised as a normal file a malicious file that is not detected by the existing antivirus product and network security product. In addition, it is assumed that there is an agent between each domain, and that there is a file management server of a site controlled by each agent. In addition, the detection of cyber attacks is assumed to utilize an existing network security server.

1 is a flowchart illustrating a method for tracking an attack source and an attack distribution site according to an embodiment of the present invention.

In the attack source and attack distribution site tracking method shown in FIG. 1, when an abnormal file is uploaded from the attack computer 100 of the attack source to the file management server 400 (hereinafter, abbreviated as 'file management server') of the site In operation S101, the file management server 400 analyzes the behavior of the upload file and extracts uploader information from the upload file when it is determined to be an abnormal file (S103).

The file management server 400 transmits the uploader information extracted through the step 103 to the agent 500 (S105).

Agent 500 stores the uploader information received from the file management server 400 (S107).

When the user computer 200 downloads the abnormal file from the file management server 400 (S109), the file management server 400 stores the downloaded user computer 200 information together with uploader information of the abnormal file ( S111).

When the user computer 200 downloads an abnormal file and detects a cyber attack, the network security server 300 transmits attack information on the cyber attack to the agent 500 (S113).

Agent 500 transmits the destination network address of the attack information received from the network security server 300 to the file management server (400) (S115), the destination network address confirmation message is received from the file management server (400) If it is (S117), the location corresponding to the destination network address is defined as the attack distribution (S119).

In addition, the agent 500 receives uploader information from the file management server 400 (S121), compares the received uploader information with pre-stored uploader information, and if it is determined that the comparison result corresponds to uploader information. Based on the attack source can be defined (S123).

2 is a flowchart illustrating a procedure performed in a file management server of a site in an attack source and attack distribution site tracking method according to an embodiment of the present invention.

When a file is uploaded to the file management server 400 in the attack source and attack distribution site tracking method shown in FIG. 2, the file management server 400 performs behavior analysis on the uploaded file (S201).

Here, the file management server 400 manages files uploaded or downloaded to the file management server 400, and such file management server 400 manages files of a portal site or various other file sharing sites, for example. It can be a server.

Specifically, the behavior analysis on the upload file is to analyze whether the upload file is a normal file or an abnormal file. This can be done in order to identify security risk bugs, parameters and abnormal files.

Here, the attribute information is for defining the logical structure of the file and may be, for example, a record length, a format, a block length, a file structure, a key length, a key position, and the like.

The file management server 400 determines whether the upload file is an abnormal file through behavior analysis in step 201 (S203), and extracts uploader information of the abnormal file when it is determined that the upload file is an abnormal file (S205).

), 네트워크 주소(

), 맥 어드레스(

), OS 정보(

), 해당 네트워크 주소에 대한 위치 정보(

) 등이 포함될 수 있다.Here, uploader information includes uploader ID (

), The network address (

), MAC address (

), OS information (

), The location information for that network address (

) May be included.

The file management server 400 generates a hash value by applying a hash function (HASH FUNCTION) to uploader information of the abnormal file extracted in step S205, and manages the generated hash value file management server 400 (500). (S207).

When the file management server 400 downloads the abnormal file from the predetermined user computer 200 after step 207, the file management server 400 stores the information of the predetermined user computer 200 that downloaded the abnormal file together with the abnormal file information (S209). ).

Here, the information of the predetermined user computer 200 may be, for example, an ID and a network address.

If the file management server 400 receives the destination network address from which the file is transmitted from the agent 500 managing the file management server 400 after step 109 (S211), the file management server 400 corresponds to the received destination network address. It is determined whether the network address is stored (S213).

Here, the destination network address may be a network address of a file uploader or a network address of a file management server.

If it is determined in step 213 that the corresponding destination network address is stored, the file management server 400 transmits a destination network address confirmation message to the agent 500 managing the file management server 400 ( S215).

Thereafter, the file management server 400 reads uploader information corresponding to the abnormal file uploader information when the abnormal file uploader information request message is received from the agent 500 managing the file management server 400. In operation S217, the uploaded uploader information is transmitted to the agent 500.

Here, the read uploader information may be decrypted and transmitted to the agent 500 in plain text.

3 is a flowchart illustrating a procedure performed by an agent in the attack source and attack distribution site tracking method according to an embodiment of the present invention.

In the attack source and attack distribution site tracking method shown in FIG. 3, when the hash value corresponding to the uploader information is transmitted from the managing file management server 400, the agent 500 transmits the transmitted hash value and the hash value. DB and store the information with the file management server 400 (S301).

Here, the information of the file management server 400 may include, for example, a MAC address, a network address (IP), OS information, location information about the corresponding network address, and the like.

When the agent 500 receives the source network address and the destination network address from the network security server 300, the agent 500 transmits the source network address among the received network addresses to the file management server 400 (S303).

Here, the destination network address may be the network address of the file uploader or the network address of the file management server 400, and the destination network address may be, for example, the network address of the user computer 200 from which the file is downloaded.

In an embodiment of the present invention, the network security server 300 is configured as an independent server used by a specific group of users. In another embodiment of the present invention, the network security server 300 is an application program installed in a user's computer. It may be configured in the form of.

When the source network address confirmation message is received from the file management server 400, the agent 500 defines a location corresponding to the source network address as an attack distribution site (S305).

After defining the file management server 400 as an attack distribution site, the agent 500 transmits an abnormal file uploader information request message to the file management server 400 (S307).

In this case, the abnormal file uploader information request message may include contents to be transmitted in plain text by decoding the abnormal file uploader information.

When the uploader information is received from the file management server 400, the agent 500 generates a hash value by applying a hash function to the received uploader information, and compares the generated hash value with a previously stored hash value. If so, the attack origin is defined using the uploader information (S309).

When the agent 500 defines the attack source in step 309, the agent 500 may transmit the attack source and distribution information to other nearby agents (S311).

Therefore, according to the attack source and attack distribution site tracking method according to an embodiment of the present invention, it is possible to track the abnormal file uploader in real time, it is possible to manage the attack scenario configuration and path for the attack source and attack distribution site. . In addition, it is possible to share the attack source and attack distribution information with the surrounding agents in real time.

1 to 3 illustrate an example of a method for tracking an attack source and an attack distribution site when the file management server 400 downloaded by the user computer 200 and the file management server 400 managed by the agent 500 are the same. However, hereinafter, when the file management server downloaded by the user computer 200 and the file management server managed by the agent 500 are different, an attack source and attack distribution tracking method will be described.

4 is a flowchart illustrating a method for tracking an attack source and an attack distribution site according to another embodiment of the present invention.

In the attack source and attack distribution site tracking method shown in FIG. 4, an abnormal file is uploaded from the attack computer 100 to the file management server 400-2 (hereinafter abbreviated as 'second file management server') of the second site. S401), the second file management server 400-2 performs behavior analysis to determine whether the uploaded file is an abnormal file (S403), and extracts uploader information when it is determined that the file is abnormal. (S405).

Here, the behavior analysis of the uploaded file is to analyze whether the uploaded file is a normal file or an abnormal file, and analyzes the attribute information of the uploaded file and compares it with the attribute information corresponding to the abnormal behavior stored in the DB. This can be done in order to identify security risk bugs, parameters, and abnormal files.

Here, the attribute information is for defining the logical structure of the file and may be, for example, a record length, a format, a block length, a file structure, a key length, a key position, and the like.

When the uploader information uploading the abnormal file is extracted in step 405, the second file management server 400-2 generates a hash value by applying a hash function to the extracted uploader information, and then removes the generated hash value. 2 The file management server 400-2 is transmitted to the second agent 500-2 that manages it (S407).

After the step 407, when the abnormal file is downloaded from the user computer 200 (S409), the second file management server 400-2 stores the user information that downloaded the abnormal file together with the uploader information (S411). .

After downloading the abnormal file from the user computer 200, when the server or the computer becomes zombie or illegal activity is detected (S413), the network security server 300 domains the destination network address and the destination network address of the abnormal file. It transmits to the first agent 500-1 managing (S415).

The first agent 500-1 may transmit the destination network address among the destination network address and the destination network address of the abnormal file received from the network security server 300 to the file management server 400-1 of the first site (hereinafter, ' Abbreviated as 'first file management server' (S417).

When the source network address is received from the first agent 500-1, the first file management server 400-1 transmits a network address corresponding to the received source network address to the first file management server 401. Determine if it is a stored network address.

If it is determined that the network address corresponding to the destination network address received by the first file management server 401 is not stored, the first file management server 400-1 does not check the destination network address. Message is transmitted to the first agent 500-1 (S419).

When the first agent 500-1 receives a message from the first file management server 400-1 that the destination network address is not confirmed, the first agent 500-1 checks the sender network address of the abnormal file at the second agent 500-2. Request (S421).

When the second agent 500-2 receives the source network address verification request from the first agent 500-1, the second agent 500-2 transmits source network address information to the second file management server 400-2 (S423). ).

When the second file management server 400-2 receives the destination network address information from the second agent 500-2, the second file management server 400-2 has a network address corresponding to the received destination network address. It is determined whether or not it is stored in 2), and if it is determined that it is stored, and transmits the destination network address confirmation message to the second agent (500-2) (S425).

When the second agent 500-2 receives the source network address confirmation message from the second file management server 400-2, the second agent 500-2 defines the location corresponding to the source network address as the attack distribution site (S427).

The second agent 500-2 defines the location corresponding to the destination network address as the attack distribution site, and then transmits an uploader information request message of the abnormal file to the second file management server 400-2 (S429). .

When the second file management server 400-2 receives the uploader information request message from the second agent 500-2, the second file management server 400-2 reads uploader information stored in advance, and reads the uploaded uploader information from the second agent 500. -2) (S431).

When the uploader information is received from the second file management server 400-2, the second agent 500-2 generates a hash value by applying a hash function to the received uploader information, and generates the hash value. If the hash value and the pre-stored hash value corresponds to the attack source using the uploader information (S433).

Thereafter, the second agent 500-2 transmits attack source and distribution information to the first agent 500-1 (S435).

In the attack source and attack distribution site tracking method according to an embodiment of the present invention, the transmission and reception procedure between the first agent 500-1 and the second agent 500-2 has been described as an example, but another embodiment of the present invention In addition to the first agent 500-1 and the second agent 500-2 may be composed of a plurality of agents, the information may be transmitted and received between the plurality of agents.

5 is a conceptual diagram of an attack source and attack distribution site tracking system according to an embodiment of the present invention.

5, the attack source and attack distribution site tracking system according to an embodiment of the present invention is the attack computer 100, the user computer 200, the network security server 300, the file management server 400 of the site and It may be configured as an agent 500.

When an abnormal file is uploaded from the attack computer 100 of the attack source to the file management server 400 (hereinafter, abbreviated as 'file management server') of the site, the file management server 400 analyzes the behavior of the uploaded file. If it is determined that the file is abnormal, uploader information is extracted from the upload file.

The file management server 400 transmits the extracted uploader information to the agent 500.

Agent 500 stores the uploader information received from the file management server 400.

When the file management server 400 downloads the abnormal file from the user computer 200, the file management server 400 stores the downloaded user computer information together with uploader information of the abnormal file.

The network security server 300 transmits attack information to the agent 500 when a cyber attack is detected after the user computer 200 downloads the abnormal file.

Agent 500 transmits the destination network address of the attack information received from the network security server 300 to the file management server 400, and when the destination network address confirmation message is received from the file management server 400 The location corresponding to the local network address is defined as the attack site.

In addition, the agent 500 receives the uploader information from the file management server 400 (S121), and when it is determined that the corresponding uploader information is compared with the pre-stored uploader information, it is determined based on the uploader information. You can specify the source of the attack.

Figure 6 is a block diagram showing the configuration of the file management server of the site of the attack source and attack distribution site tracking system according to an embodiment of the present invention.

6, the file management server 400 of the attack source and attack distribution site tracking system according to an embodiment of the present invention is the behavior analysis unit 410, file management server storage unit 420, information extraction unit 430 ), A file management server control unit 440 and a file management server communication unit 450.

When the file is uploaded to the file management server 400 by the file uploader, the behavior analyzer 410 performs behavior analysis on the uploaded file and provides the analysis result to the file management server controller 440.

Specifically, the behavior analysis on the upload file is to analyze whether the upload file is a normal file or an abnormal file. This can be done in order to identify security risk bugs, parameters and abnormal files.

The information extraction unit 430 extracts uploader information of the abnormal file and provides the file management server control unit 440.

), 네트워크 주소(

), 맥 어드레스(

), OS 정보(

), 해당 네트워크 주소에 대한 위치 정보(

) 등이 포함될 수 있다.Here, uploader information includes uploader ID (

), The network address (

), MAC address (

), OS information (

), The location information for that network address (

) May be included.

The file management server controller 440 transmits the hash value generated by applying the hash function to the uploader information of the abnormal file provided from the information extraction unit 430 through the file management server communication unit 450. Send to the managing agent 500.

When the predetermined users download the abnormal file, the file management server controller 440 stores the information of the predetermined users who downloaded the abnormal file in the file management server storage 420 along with the abnormal file information.

Here, the information of the predetermined users may be, for example, an ID and a network address.

When the source network address is received from the agent 500 managing the file management server 400 through the file management server communication unit 450, the file management server controller 440 corresponds to the received source network address. It is determined whether the network address is in the file management server storage unit 420.

When the file management server controller 440 determines that there is a network address corresponding to the destination network address received in the file management server storage unit 420, the file management server control unit 440 transmits the destination network address confirmation message to the file management server communication unit 450. The file management server 400 manages the transmission to the agent 500.

The file management server controller 440 reads uploader information from the first storage unit 420 when an abnormal file uploader information request message is received from the agent 500 managing the file management server 400. The read uploader information is transmitted to the agent 500 managing the file management server 400 through the file management server communication unit 450.

7 is a block diagram showing the configuration of an agent in the attack source and attack distribution site tracking system according to an embodiment of the present invention.

7, the agent 500 of the attack source and attack distribution site tracking system according to an embodiment of the present invention is the attack distribution site tracking unit 510, agent storage unit 520, attack source tracking unit 530, The agent controller 540 and the agent communication unit 550 may be configured.

When the agent control unit 540 receives the hash value for the uploader information from the file management server 400 through the agent communication unit 550, the agent control unit 540 together with the file management server information transmitting the uploader information And store in the agent storage unit 520.

Here, the file management server information may include, for example, a MAC address, a network address (IP), OS information, location information on the corresponding network address, and the like.

When the agent control unit 540 receives the source network address and the destination network address from the network security server 300 through the agent communication unit 550, the agent control unit 540 attacks the distribution target tracking unit 510. To provide.

The attack distribution site tracking unit 510 generates a confirmation request message for the destination network address provided from the agent control unit 540 and provides it to the agent control unit 540.

The agent controller 540 transmits a confirmation request message for the destination network address provided from the attack distribution site tracking unit 510 to the file management server 400 through the agent communication unit 550.

The agent controller 540 provides the attack distribution site tracking unit 510 with the destination network address confirmation message received from the file management server 400.

When the attack distribution point tracking unit 510 receives the destination network address confirmation message, the attack distribution point tracking unit 510 defines a location corresponding to the destination network address as the attack distribution site.

When the attack distribution point tracking unit 510 defines the location corresponding to the source network address as the attack distribution point, the agent controller 540 transmits the uploader information request message of the abnormal file to the file management server 400.

When the uploader information is received from the file management server 400, the agent controller 540 provides the received uploader information to the attack source tracking unit 530.

When the upload source information is provided from the agent control unit 540, the attack source tracking unit 530 generates a hash value by applying a hash function to the uploader information provided, and advances the generated hash value and the agent storage unit 520 in advance. If it is determined that the correspondence is compared with the stored hash value, the attack source is defined using the uploader information.

When the attack source tracking unit 530 completes the attack source specification, the agent controller 540 transmits the prescribed attack source and distribution information to other nearby agents through the agent communication unit 550 (S211).

Therefore, according to the attack source and attack distribution site tracking method according to an embodiment of the present invention, it is possible to track the abnormal file uploader in real time, it is possible to manage the attack scenario configuration and path for the attack source and attack distribution site. . In addition, it is possible to share the attack source and attack distribution information with other agents in real time.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. It will be possible.

Claims (1)

In the method of tracking the origin and distribution of attacks performed by the agent,
Transmitting information of an abnormal file among the received information;
Defining a location corresponding to the information of the abnormal file as an attack distribution site when an information confirmation message of the abnormal file is received in response to the transmission of the information of the abnormal file;
Transmitting the abnormal file uploader information request message after defining the attack distribution site; And
When the abnormal file uploader information is received in response to the request message, when the abnormal file uploader information is compared with the pre-stored uploader information, and the comparison result is determined to correspond, the abnormal file uploader information is used. A method for tracking the source and distribution of attacks, including the step of defining the source of attack.

Images