Implementation of Autonomous Intrusion Analysis Agent(AIAA) and Tool for using Intruder Retrace

인터넷 해킹피해 시스템자동분석에이젼트(AIAA) 및 침입자 역추적 지원도구 구현

Autonomous Intrusion Analysis Agent(AIAA) is Incident Response Team staff's tool that scans, analyses, reports and alerts the traces of intrusion based on system logs and intruder's backdoors inside compromised system by IR staff after security incident is reported to the IR team. AIAA is intelligent to recognize to check out who is intruder from all the user accounts and to report the suspected candidates to the master control system in IR team. IR staff who controls AIAA with master system can pick up an intruder from the candidates reported by AIAA agent and review all related summary reports and details including source host's mane, finger information, all illegal behavior and so on. AIAA is moved to compromised system by the staff to investigate the signature of intrusion along the trace of victim hosts and it is also operated in secret mode to detect the further intrusion. AIAA is alive in all victim systems until the incident is closed and IR staff can control AIAA operation and dialogue with AIAA agent in Web interface.