Method and system for identifying attack infrastructure

Abstract

There is provided a method for identifying attack infrastructure, performed by a computing system. The method may comprise collecting network traffic data of a host device that is the target of a security incident, acquiring, from the network traffic data, first data regarding port numbers recorded in the network traffic data, second data regarding protocols recorded in the network traffic data, and third data regarding textual information included in network packets recorded in the network traffic data or category information provided by network equipment, automatically identifying attack infrastructure corresponding to the first data, the second data, and the third data by using a predefined classification model and blocking network access of an Internet Protocol (IP) address associated with the attack infrastructure, wherein the attack infrastructure corresponds to resources utilized by an attacker during the security incident.