Implementation of Netflow based Interactive Connection Traceback System

摘要

The paper proposes a method and system for finding stepping stones, as well as origins of the advanced cyber attacks based on the interactive connections traceback system. To do so, the traceback system to be installed at the enterprise gateway utilizes distributed netflow collectors that subscribe netflow information from nearby edge routers with command configured to support netflow generation and traceback agents for finding real-time connections from the victim to attacker. By implementing such a system would support the real-time connection traceback of the attack origins for the interactive hacking attacks without any helps of the Internet Service Providers or governmental security organizations.