System and method for tracking malware route and behavior for defending against cyberattacks

A method for tracking a malware route and behavior in order to defend against cyberattacks, comprising:

• collecting, by multiple hosts, first event data concerning object behavior and creating, by the multiple hosts, pieces of host-based event information using the first event data;
• storing, by the multiple hosts, the pieces of host-based event information in a tracking information database server;
• creating, by a tracking information analysis server, behavior events by defining malware behavior from the pieces of host-based event information;
• retrieving, by the tracking information analysis server, a target to be analyzed from the pieces of host-based event information and the behavior events based on a preset input value;
• creating, by the tracking information analysis server, first tracking contexts, through which the malware behavior is capable of being identified, by analyzing a relationship between the pieces of the host-based event information and a relationship between a set of the pieces of the host-based event information and a set of the behavior events;
• and
• creating, by the tracking information analysis server, second tracking contexts, through which a malware route and behavior events between the multiple hosts are capable of being tracked, by analyzing a correlation between the first tracking contexts.