In 2020, we noticed that the Taiwan Government Service Network (GSN) had attack traffic to extranet. If a botnet can infiltrate a system, APTs or targeted attacks may also be able to infiltrate it. This study will reveal the network attack behaviors collected from Taiwan and critical infrastructure from around the world (including oil, water, electricity, government agencies, etc.). By analyzing this information, which is suspected to have been invaded and used as an attack tool, we can gain insight into the possible weaknesses of critical infrastructure in various countries and use this knowledge to assist in constructing our own possible defense mechanisms.