Cyber-attack tracking method and device using behavior event-based relationship data collected from multiple domains, and storage medium storing instructions to perform cyber-attack tracking method

Abstract

Proposed is a method for tracking a cyber-attack to be performed by a cyber-attack tracking device including a memory and a processor. The method may include determining a plurality of behavior events performed by network devices in one or more domains, and mapping the plurality of the behavior events onto metadata of preset standards. The method may also include generating relationship data indicating a relationship between behavior events mapped onto metadata designated as a preset group based on the metadata mapped onto the behavior events. The method may further include counting a number of behavior events related to a preset suspected behavior among behavior events having a relationship data same as a relationship data of a first behavior event to calculate score for the relationship data including the first behavior event.